Security & trust

Secure by architecture,
not by promise.

serv365 reads your Microsoft 365 configuration to answer one question — does this change affect you? Everything about how it's built makes that safe: read-only, agentless, no credentials of yours stored, and revocable in a single click that Microsoft — not us — enforces.

🔒 Read-only — provably

The permissions we request cannot write to your tenant. The engine enforces a Get-* allowlist with a per-command audit trail, and the roles you assign (Global Reader) are read-only by definition. Not a policy — an architecture.

🛰️ Agentless

Nothing is installed in your tenant or on any endpoint. There's no agent to patch, no software to compromise, no inbound listener into your environment. All traffic is outbound, over TLS.

🔑 No credentials of yours, ever

Access works through Microsoft's app-consent model — your admin grants consent, Microsoft issues us short-lived tokens. We authenticate with a certificate, not a password. Nothing of yours is ever stored.

🎚️ Least privilege, revocable instantly

We request only read scopes; you assign the read roles. Delete the serv365 enterprise app in Entra and access stops immediately — enforced by Microsoft, not by us.

📄 Configuration, not content

We read settings and policies. We cannot read mail, files, chats or user content — the permission list makes it verifiable. Data minimisation by design.

🧱 Isolation, enforced twice

Every tenant's data is walled off by PostgreSQL row-level security and per-tenant tokens. Role-based access mirrors your tenant's own boundaries — an Exchange admin sees Exchange, not Purview. One tenant can never see another.

Encrypted end to end, hosted in the UK

  • In transit & at rest: TLS everywhere; Azure Database for PostgreSQL encrypted at rest.
  • Secrets: our certificate and connection strings live in Azure Key Vault, reached only through managed identities — never in code or config.
  • Residency: hosted in Azure UK South. Automated backups, 7-day point-in-time recovery, held off-site.
  • Sign-in: humans sign in with their own Microsoft work account (Entra SSO), scoped to their admin role — no shared passwords, no separate credentials.

Built to a security engineering bar

  • Every change is gated: automated linting, strict static type-checking and a full test suite must pass before any code ships — enforced in CI, not by convention.
  • No stored cloud credentials: deployments authenticate to Azure with GitHub OIDC federation and run under managed identities.
  • Minimal supply chain: integrations are raw REST over a small, audited dependency set — no heavyweight vendor SDKs to trust.
  • Adversarially reviewed: the codebase is regularly probed for auth, isolation and abuse flaws, and findings are fixed and regression-tested.
  • Everything is auditable & diffable: every read is recorded; every configuration value is hashed and version-diffed, so there's a complete, provable history.

Your data, your control

  • Export your configuration any time (CSV, point-in-time snapshots).
  • Revoke instantly — remove the enterprise app in Entra and collection halts; we mark the tenant revoked automatically.
  • Delete on request — email us from a tenant admin address and stored data is purged within 7 days, confirmed.

Subprocessors: Microsoft Azure only (hosting, database, Key Vault, email — UK/EU regions). No analytics or advertising third parties; the public site sets no tracking cookies.

Security questions, a security review, or a data-processing agreement? Talk to us or email contact@serv365.ai.