Security & data handling

Mercury connects to Microsoft 365 through Microsoft Graph using OAuth. We never ask for or store your email password. Access is granted by your own Microsoft sign-in and can be revoked from your Microsoft account at any time, which immediately stops Mercury from sending or reading.

• Signing in to Mercury requests only your identity — mailbox permissions are a separate, later consent
• Access tokens are refreshed automatically and stored encrypted at rest
• Mercury reads your inbox and sent items to match replies to leads; it does not scan unrelated folders
• Message content is used only inside your own workspace, never to train models

Voice cloning is opt-in and self-service. A rep records their own sample and approves it; nobody else can enroll a voice on their behalf, and Mercury will not clone a voice from a call recording or any third-party audio.

• A voice profile belongs to the person who recorded it and can be deleted at any time
• Deleting a profile deletes the underlying model, not just the reference to it
• A voice is never used for another user’s campaigns, inside or outside your organization
• Voice data is treated as biometric data and encrypted at rest

Each organization's data is isolated. Leads, campaigns, messages, and call records belong to one workspace and are scoped to it at the data layer rather than by convention in application code.

• Role-based access inside a workspace: admins, supervisors, and agents see different things
• Data is exportable — it is your list, and you can take it with you
• Transport is encrypted end to end (TLS); data is encrypted at rest

• We do not send through shared IP pools — your mail goes out from your own mailbox
• We do not run an artificial inbox network to fake engagement signals
• We do not ship an AI agent that claims to be a human when asked
• We do not remove the per-lead contact limits, however much volume you want

If you have found a security issue, email us and we will respond. We will not pursue legal action against researchers who report issues in good faith and give us a reasonable window to fix them before disclosure.