SEARCHFLOW
EN

For IT administrators

Technical and security information for evaluating and deploying SearchFlow in a Microsoft 365 tenant.

Overview

SearchFlow is a Windows desktop application published by DomusFlow BV, Belgium. It indexes a user's Microsoft 365 mailbox, OneDrive and SharePoint documents and selected file-server folders on the user's own computer and searches them locally. Access to Microsoft 365 is delegated and read-only: the application acts as the signed-in user and reads only what that user can already open. File-server folders are read with the user's Windows credentials and require no Microsoft permission.

Permissions

One multitenant app registration in Microsoft Entra ID: SearchFlow, application (client) ID 19a659cd-b965-44e7-9465-3fbed07d7b21. Delegated Microsoft Graph permissions, all read-only:

Mail.Read
Read the user's mailbox.
Files.Read.All
Read the user's OneDrive files and the SharePoint documents the user has access to.
Sites.Read.All
List the SharePoint sites and libraries the user has access to.
User.Read
Sign the user in and read the user's profile.
MailboxFolder.Read
MailboxItem.Read
MailboxItem.Export
Read the user's online archive mailbox. Used only when archive indexing is enabled.
openid
profile
offline_access
Standard sign-in scopes; keep the user signed in.

No application permissions and no client secret. Publisher verification with Microsoft is pending; the consent page shows the publisher as unverified.

Under Microsoft's default consent policy, Mail.Read, Files.Read.All and Sites.Read.All require administrator consent. Until it is granted, users see “Need admin approval” at sign-in.

  1. Sign in as a Global Administrator, or another role permitted to grant tenant-wide consent, at:
    https://login.microsoftonline.com/organizations/adminconsent?client_id=19a659cd-b965-44e7-9465-3fbed07d7b21&redirect_uri=https://searchflow.be/approved
  2. Review the listed permissions and select Accept.
  3. The browser opens a SearchFlow page that shows whether the approval is complete.

Consent covers all listed permissions for all users in the tenant. Granted permissions can be reviewed under Entra admin center → Enterprise applications → SearchFlow → Permissions.

Note: consenting through “Have an admin account? Sign in with that account” on a user's device signs the administrator's mailbox in to that installation and covers mail only. Use the link above.

Data

On the user's computer

  • The search index: message and document text, file names and metadata, in %LOCALAPPDATA%\DomusSearch in the user profile.
  • Microsoft access and refresh tokens, in the same folder. Used only with Microsoft; never transmitted to DomusFlow.
  • Temporary copies of documents opened from the application, under %TEMP%, removed after seven days.
  • Application logs.

Typed search runs locally; only the number of searches is reported with the licence check. Indexing reads mail and documents directly from Microsoft; no content passes through the DomusFlow service.

Sent to the DomusFlow service (searchflow-server.vercel.app)

  • Licensing. Installation identifier, application version and language, usage counts and the Microsoft identity (ID) token of each signed-in mailbox. The token's signature is verified and only its e-mail address is retained. It grants no access to mail or documents.
  • Diagnostics. Application logs: installation identifier, version, the domains of the signed-in accounts, synchronisation activity (folder, library and file names, counts) and errors. E-mail addresses are reduced to their domain. Retained for 14 days.
  • Ask. The question and the message and document passages retrieved to answer it are relayed to OpenAI's API. DomusFlow retains usage counts and status per installation, not the content. OpenAI processes the request with storage disabled, may retain it for up to 30 days for abuse monitoring (longer only where legally required) and does not use it for training.

Security

  • Transport. All connections to Microsoft, the DomusFlow service and OpenAI use TLS. The application's interface is served on the loopback interface only and answers its own window alone; no network port is exposed.
  • At rest. The index and sign-in tokens are stored in the user profile and are not encrypted by the application. Device disk encryption (BitLocker) is the recommended control.
  • Service. The DomusFlow service runs on Vercel (Frankfurt) with a Neon PostgreSQL database. Per installation it holds the e-mail address of each signed-in mailbox, licence state, usage counts and 14 days of logs. It holds no mail, documents or questions. Data at the service is encrypted in transit and at rest by the hosting providers; access is limited to the DomusFlow staff who operate it. Security incidents affecting customer data are reported to the affected customers without undue delay.
  • Assurance. No independent audit (SOC 2, ISO 27001) has been performed.
  • Sub-processors. Vercel (hosting), Neon (database), OpenAI (Ask), Stripe (payments). Website only: Microsoft Clarity (analytics), Formspree (contact form).
  • Code signing. The installer and the application are signed by DOMUSFLOW BV.
  • Security contact. sales@domusflow.io.

Deployment

  • Requirements. Windows 10 or 11. Setup installs the Microsoft Edge WebView2 runtime if it is not present.
  • Installation. Per user, without administrator rights, to %LOCALAPPDATA%\Programs\SearchFlow. No service or scheduled task. A startup entry for the current user is enabled by default and can be deselected during installation. Download: searchflow.be/start.
  • Updates. The application checks domussearch.vercel.app for updates, downloads them in the background and installs them silently per user at the next start or when idle.
  • Silent installation. SearchFlow-<version>-setup.exe /VERYSILENT /SUPPRESSMSGBOXES; add /MERGETASKS="!startup" to omit the startup entry.
  • Uninstall. Windows Settings → Apps → SearchFlow → Uninstall, or unins000.exe /VERYSILENT in the installation folder. The data folder remains until it is deleted.
  • Outbound connections (all HTTPS): login.microsoftonline.com, graph.microsoft.com and the Microsoft 365 download hosts (*.sharepoint.com); searchflow-server.vercel.app (licensing, diagnostics, Ask); domussearch.vercel.app (updates); searchflow.be (help content).
  • Administration. Settings are per user; there is no central management console.

Revoking access

  • Tenant-wide. Entra admin center → Enterprise applications → SearchFlow → Properties → Delete; or set “Enabled for users to sign-in?” to No to block sign-in and keep the entry.
  • Per user. In the same Properties, set “Assignment required?” to Yes and manage Users and groups.

After revocation the application can obtain no new tokens. Content already indexed remains on the computer until the account is removed in Settings or the data folder is deleted.

Contact

sales@domusflow.io. DomusFlow BV, Knokke-Heist, Belgium, VAT BE 0750792272.

Last updated 14 October 2026.