Security & IT
What IT needs to know, on one page.
How Right Hand connects to Microsoft 365, what your IT team approves, how each client’s deployment is isolated, and how to switch it off.
Control
Autonomy, with you in control.
Right Hand decides, delegates and does the legwork. You stay the one who signs: every step is visible, and nothing is submitted or paid without your approval.
You approve every submit and payment
The browser agent fills the form, attaches the documents and then waits. Submit and Pay stay locked until you sign.
Every step shown and logged
You can watch the agent work, and every action it takes is written to a log you can review later.
- 10:02:11Opened the vendor-payments portal
- 10:02:19Matched beneficiary from INV-2291
- 10:02:24Entered ₹18,40,000 from the invoice
- 10:02:32Stopped for approval
One private deployment per client
Each client is served from its own subdomain and its own cloud project. The walls are structural: there is no shared mail store to leak from.
Data never pooled across clients
- 01Walled desksPerson and function desks are visible only to their members.
- 02Your precedent stays yoursWhat Right Hand learns from your decisions lives in your deployment.
- 03You can switch it offUsers and IT can disconnect at any time.
Permissions
| Permission | Type | Why | When |
|---|---|---|---|
User.Read | Delegated | Sign the user in; read basic profile | At connection |
Mail.Read | Delegated | Read mail to build matters, actions, tasks and the tracker | At connection |
offline_access | Delegated | Refresh tokens (stored encrypted) so access continues without repeated sign-in | At connection |
| Additional scopes | Delegated | Requested only when a feature that needs them is enabled; shown on the Microsoft consent screen for approval | When enabled |
Multi-tenant Microsoft Entra application · work or school accounts only · MSAL authorisation-code flow with PKCE.
Admin approval (consent)
Since Microsoft’s 2025 changes to default consent settings, many tenants no longer let users approve apps that read mail. In that case:
- The user gets a ready link for IT when Microsoft asks for admin approval. They can copy it or have us email it to their IT team.
- IT approves once on that page, which explains what SaarthiOS can and cannot do and opens Microsoft’s own admin consent screen. It is the standard Microsoft link:
https://login.microsoftonline.com/organizations/v2.0/adminconsent?client_id=<SaarthiOS application ID> - Everyone waiting is told by email, then signs in again and connects.
Restrict to named users (optional)
In Microsoft Entra admin center → Enterprise applications → SaarthiOS → Properties, setAssignment required to Yes, then add the users or groups who may sign in under Users and groups.
Connecting many mailboxes
For larger roll-outs there is an older, IT-led path: an admin-registered app with application permissions and scripts, set up together with your IT team.
Deployment model
- One deployment per client, in its own cloud project, served at
<client>.saarthios.online. - Client data is never pooled with other clients’ data.
- SaarthiOS Connect (
connect.saarthios.online) handles sign-in and mailbox permissions for all SaarthiOS products; client deployments get short-lived access from it, never your sign-in. - Inside a deployment, desks are private: person desks to their owner, function desks to their members.
Disconnecting
- User: disconnect at connect.saarthios.online/disconnect, or remove SaarthiOS at
myapps.microsoft.com. - IT: remove the user’s assignment, revoke consent, or delete the enterprise application in Microsoft Entra.
Publisher verification
Publisher verification is through the Microsoft AI Cloud Partner Program using the saarthios.online domain. The domain association file is published at/.well-known/microsoft-identity-association.json.
What we don’t claim
Right Hand is in early access. We do not currently claim third-party certifications. If your security review needs a questionnaire answered, write to hello@saarthios.com.
Get your Right Hand.
One Right Hand for every desk. Decides, delegates, gets it done — with you approving what matters. Early access on Microsoft 365.
Request early access