Radar security summary
For whoever is asked to approve Radar: what it reads, what it writes, why it needs each permission, and what it does not have yet. Download as PDF
Who runs it. Neos Technologies Ltd, company no. 17333336, registered in England and Wales. Radar reads the calendars, inboxes, task lists and CRMs someone connects, and shows what is closing in over the next ninety days. It is read-only unless a person presses a button.
Where it runs. Radar runs on servers we control in the United Kingdom. The database is not reachable from the internet, and every request arrives over HTTPS.
What it keeps. Radar keeps a working cache of what your connected systems return, so the screen is fast: email sender, subject and preview, calendar events, tasks and CRM records. The records themselves stay in the systems that own them. Disconnecting a system deletes its cache at once. Cached email is deleted after 30 days. Connection credentials and tokens are encrypted at rest with AES-256-GCM and never sent to a browser. Passwords are hashed with Argon2id.
Signing in. Two-factor sign-in with an authenticator app, recovery codes, and a fresh code before sensitive actions such as exporting or deleting data. A workspace owner can require it of everyone in the workspace.
Backups. Encrypted nightly backups. A restore into a scratch database is tested every week, and an encrypted copy of each backup is kept off-site with Backblaze B2.
AI. AI drafting is optional. Nothing is sent to an AI provider unless someone asks for a draft, and Radar never sends an email or changes a CRM record without a person pressing the button. Xero data and calendar events are never sent to AI.
What Radar does not have yet. Radar has not had an independent penetration test, and holds no security certification (such as Cyber Essentials) yet. We would rather say so than let you assume otherwise.
What Radar reads and writes
| Connection | Reads | Writes — only when you press the button |
|---|---|---|
| Microsoft 365 and Outlook.com | Outlook mail; Outlook calendar; Microsoft To Do; Microsoft Planner; Word, Excel and PowerPoint comments | Reply to a message; Create a task, rename or reschedule one, mark a task or Planner task complete; Reserve a focus block in your calendar |
| Gmail (beta) | Gmail; Docs, Sheets and Slides comments | Send a reply |
| Google Calendar and Tasks (beta) | Google Calendar; Google Tasks | Nothing. Read-only. |
| Calendar feed (ICS) | A subscribed calendar | Nothing. Read-only. |
| Pipedrive | Activities assigned to you; Open deals; Persons and organisations | Create a follow-up activity, mark one done |
| Odoo | Activities assigned to you | Mark an activity done |
| OpenAI | — | Draft a reply and propose a follow-up |
| Xero (beta) | Sales invoices still owed; Quotes about to expire; The customer behind each one | Nothing. Read-only. |
| Salesforce (beta) | Opportunities you own; Contact roles; Open tasks | Create a task |
| Zoho CRM (beta) | Deals; Contacts; Open tasks | Create a task |
| monday.com (beta) | Items assigned to you | Nothing. Read-only. |
| Slack (beta) | Messages that mention you | Nothing. Read-only. |
| Asana, Trello, ClickUp, Notion, Jira, Linear, Todoist (beta) | Tasks assigned to you | Asana: mark a task complete; Todoist: close a task |
Every permission Radar asks for
Radar asks only for delegated permissions: it acts as the person who connected, and never as an application with access to everyone’s mailbox. So an administrator with the Cloud Application Administrator role can approve it; Global Administrator is not needed.
Microsoft 365 and Outlook.com
| Permission | Why Radar asks for it |
|---|---|
openid, profile, email | Sign-in: which account you connected, with its name and address to label the connection. |
offline_access | Keeps syncing without asking you to sign in again each time. |
User.Read | Your own profile, to tell a work account from a personal one. |
Mail.Read | Reads your mail for the Priority Inbox: sender, subject, preview and flags. Radar never moves, deletes or marks a message. |
Mail.Send | Sends a reply you wrote and pressed Send on. Never by itself. |
Calendars.ReadWrite | Reads your calendar to work out how much time is free. Writes only when you reserve a focus block. |
Tasks.ReadWrite | Reads your To Do and Planner tasks. Writes only when you create, edit or complete one in Radar. |
Gmail
| Permission | Why Radar asks for it |
|---|---|
openid, email, profile | Sign-in: which account you connected, with its name and address to label the connection. |
gmail.readonly | Reads your mail for the Priority Inbox. Read-only: Radar cannot change or delete a message. |
gmail.send | Sends a reply you wrote and pressed Send on. Never by itself. |
Google Calendar and Tasks
| Permission | Why Radar asks for it |
|---|---|
openid, email, profile | Sign-in: which account you connected, with its name and address to label the connection. |
calendar.events.readonly | Reads events in your primary calendar. Read-only. |
tasks.readonly | Reads your Google Tasks. Read-only. |
Xero
| Permission | Why Radar asks for it |
|---|---|
offline_access | Keeps syncing without asking you to sign in again each time. |
accounting.invoices.read | Reads the invoices and quotes you chose to see. Read-only. |
accounting.contacts.read | Reads the customer on each invoice or quote. Read-only. |
Generated from Radar’s own code on the day this page was built, so it says what the software does rather than what we remember it doing. Questions: [email protected].