Found Opportunity

Security & Trust

Last Updated: December 2025

Protecting your data — and your clients' privacy — is the foundation of our platform.

This page explains, clearly and transparently, what we access, what we never access, how we secure it, and what protections exist even in a worst-case scenario.

We designed Found Opportunity for real-estate professionals who rely on confidentiality, speed, and accuracy — including agents dealing with VIP, high-net-worth buyers and sellers. Our approach is simple:

Only access the spam folder.
Never access the inbox, sent mail, drafts, or any other folder.
Read-only permissions — we cannot send, delete, or modify emails.
Data auto-deletes within 7 days.
You can disconnect instantly at any time.

For IT & Security Teams

We've prepared a detailed security questionnaire you can review or share internally:

📄 Download Found Opportunity Security Questionnaire (PDF)

Last updated: December 7, 2025 • Version 1.0

Need a completed vendor form, DPA, or additional documentation? Email support@foundopportunity.com

1. What We Access (and Why)

Found Opportunity uses OAuth to connect to Gmail or Outlook so we can scan only your spam folder and alert you when a valuable lead ends up there.

We Access:

This is the minimum required to detect renter inquiries, buyer leads, referrals, and FSBO messages that were incorrectly flagged as spam.

We Do Not Access:

Our code never queries or processes any folder except spam/junk (Gmail SPAM and Outlook "Junk Email"/"Junk").

2. Why You Can Trust That We Only Access Spam

Gmail and Outlook do not provide a "spam-only" permission level — the API technically allows reading all folders — so we provide multiple layers of protection:

Code-Level Enforcement (Primary Protection)

For Gmail, every email query includes:

labelIds: ['SPAM']

For Outlook/Microsoft 365, every email query is restricted to folders where:

displayName.lower() in ("junk email", "junk")

This guarantees we only fetch spam/junk emails. There is no code path that queries inbox or sent mail.

Failsafe / Circuit Breaker

A separate guard runs before every scan:

Google Oversight (CASA Tier 2 Certified)

Google's OAuth verification process includes ongoing compliance requirements. Apps that deviate from declared permissions risk having OAuth access revoked. This provides external accountability alongside our internal controls.

We have been verified through TAC Security's CASA Tier 2 assessment. This is the same level used by major SaaS tools that connect to Gmail.

Legal & Contractual Protection

Our Terms of Service contractually guarantee:

"Found Opportunity shall not access, collect, view, process, store, or analyze any email data contained in a user's inbox, sent mail, drafts, trash, or any folder other than designated spam/junk folders. The software is architected and contractually required to exclusively request email data identified by Google's 'SPAM' label or Microsoft's 'Junk Email'/'Junk' folders via read-only API scopes. Any deviation from this limitation constitutes a breach of these Terms."

Privacy-by-Design Architecture

3. Read-Only Permissions = We Cannot Send or Modify Email

Our OAuth scope is gmail.readonly / Mail.Read.

This means:

cannot send email
cannot delete email
cannot move email
cannot mark unread/read
cannot access drafts
cannot modify labels or folders

We can only read spam messages — nothing else.

4. What Happens If You Disconnect

You can disconnect anytime:

Once disconnected:

5. Data Handling & Auto-Deletion

We Store (for 7 Days Only):

We Also Store:

We Never Store:

Opportunity data is automatically deleted after 7 days.

6. Encryption & Infrastructure

Encrypted At Rest and In Transit

Hosted on DigitalOcean (SOC 2, ISO 27001)

7. Security Monitoring & Controls

8. Worst-Case Scenario: What If We Were Hacked?

Even in the unlikely event of a server breach:

An attacker still could NOT:

What they could access:

To access inbox or sent, an attacker would need to:

  1. Breach the server
  2. Access the encrypted OAuth token
  3. Rewrite the application code
  4. Bypass the spam-only failsafe
  5. Execute unauthorized Gmail queries
  6. Avoid detection by Google OAuth monitoring
  7. Avoid triggering our own internal anomaly alerts

This is a multi-stage, high-effort, high-risk chain involving detection points at every step.

This layered defense makes inbox compromise extremely unlikely.

9. Third-Party Security

We only share data with vendors essential to providing the service:

We minimize the data shared with each provider and do not sell user or email data.

10. You Stay in Control

When you delete your account, active records (account data, opportunity data, processed email hashes) are deleted without undue delay (typically within seconds), and any remaining copies in encrypted backups are overwritten as backups rotate (within approximately 7 days).

Need to Talk Security?

We're always available to answer technical questions — including from IT teams, CTOs, and security officers.

📧 privacy@foundopportunity.com