Secure Mail Merge for Outlook

No. The spreadsheet is read and the emails are assembled inside Outlook on your own machine. The finished messages go to Microsoft Graph, the same interface Outlook uses to send any email, and then to your recipients. Your recipient data is never transmitted to SecureMailMerge or to any third party, and you can confirm that in the add-in network traffic: besides Microsoft Graph, the add-in only sends the license check, anonymous usage counts, and error reports, none of which carry recipient data.

Two things: the add-in, and the permissions it requests. Install it from AppSource, or deploy it centrally from the Microsoft 365 admin center. Each permission is granular and documented with its reason on the permissions page: sign-in and profile, contacts, calendar read, mail read and write, mailbox settings, and a refresh token. Your spreadsheet needs no Microsoft permission at all, because it is read locally. For firewall rules, one host is required beyond your existing Microsoft 365 endpoints: https://www.securemailmerge.com, with GET to load the add-in and POST to the license endpoint. Two more are optional and can stay blocked: analytics.solinventum.com for anonymous usage counts and Sentry for error reports.

No, and there is nothing to store. We operate no server that receives email content, attachments, or spreadsheets. Our licensing server checks whether your own email address holds a commercial license. It performs no mail merge work, and that request carries only your email address, a product name, and a timestamp.

Designed for it, not certified against it. We hold no certification seal. In practice: your recipient data and message content stay inside your own Microsoft 365 tenant, so your existing retention, DLP, and audit controls keep applying. Sol Inventum OÜ is an EU company registered in Estonia, and we provide a signed Data Processing Addendum for the limited processing we do perform.

All four Outlook versions, yes. It runs in classic Outlook on Windows, the new Outlook, Outlook for Mac, and Outlook on the web. Shared mailboxes work in the send-as direction: create the email in your own mailbox, change the "From" address to the shared mailbox, then run the campaign as normal, if your tenant already lets you send from that address. Recipients see the shared mailbox and replies go back to it, though the sent copy lands in your own Sent Items. Opening the add-in inside a shared mailbox is not supported, because Outlook does not allow it.

Word cannot attach a different file per recipient, cannot send from the new Outlook or Outlook on the web at all, and gives you no preview of the finished messages. Newsletter platforms upload your recipients to their cloud and send from their own infrastructure, which puts your recipient data under their retention and access controls. SecureMailMerge runs natively in every Outlook version, supports per-recipient attachments, cc and bcc, fallback values, and scheduling, and sends one-to-one from your own mailbox, so replies come back to you normally.