We can only look, never change. And you can always audit everything we've looked at.
We can't create users, change settings or send emails. Just look — and tell you what we see.
No software on your machines and no changes to your systems. Up and running in two minutes.
Access can be revoked by you, any time — without asking us first.
All your data is stored in Frankfurt.
Within 30 days of cancellation, all your data is gone from us.
Every look we take is automatically logged at Microsoft in your own systems — in a log we can't edit.
Three providers are involved. All located in the EU. None resell your data, and DPAs are in place.
| Provider | What they do | Where | Scope |
|---|---|---|---|
| Supabase | Database + login | EU · Frankfurt | All persisted data |
| Microsoft Graph | The API we read your setup through | EU · your own Microsoft 365 | Look-only access enabled by you |
| Vercel | Portal hosting | EU · Frankfurt | No persistent customer data |
Multi-tenant app registration in Microsoft Entra with read-only Microsoft Graph permissions. The key ones are Directory.Read.All, Policy.Read.All, UserAuthenticationMethod.Read.All, RoleManagement.Read.All, AuditLog.Read.All, DeviceManagementManagedDevices.Read.All, Application.Read.All and Reports.Read.All — all read-only. The full list (~30 Graph permissions, all Read.All) is shown on the consent screen before you approve.
Activated by Global Administrator consent. Can be revoked at any time in Enterprise applications → SimpleEntra → Permissions → Revoke. Takes 30 seconds.
All persisted data lives in Supabase Postgres (AWS eu-central-1, Frankfurt). Encryption at rest: AES-256 via AWS KMS. TLS 1.2+ on all connections. Graph tokens aren't stored persistently — they're fetched fresh via client credentials flow per call.
Each tenant's data is isolated by tenant_id in the database, and access only happens through server-side code that filters by tenant before every query.
Every Graph call is automatically logged in your own Entra ID under sign-in logs (filtered on our service principal). You own the log — we have no ability to delete or modify it. The log can be exported to Sentinel, Splunk or whatever you use.