Stored connection data
A connection record contains its ID, generated username, connected email address, password salt and verifier, encrypted token material, creation/update times, and an optional revocation time.
Message transit
The SMTP process reads the MIME message into memory, submits a base64 representation to Microsoft Graph, and does not store the message body in the application database. The process necessarily handles message content transiently to deliver it.
Delivery counters
After Graph accepts a submission, smtpify365 stores a credential ID and timestamp. The dashboard aggregates these records for the last hour, last seven days, and all time. This is not detailed delivery or recipient history.
Account sessions
Dashboard access uses a random account-session token stored as a secure HTTP-only cookie in production. The database stores a hash of that token with the email address and expiration time.
Known documentation boundary
This page intentionally does not state hosting location, backup retention, infrastructure log retention, or deletion schedules because those facts are not defined by the inspected application code.