Read-only, agentless, and nothing written — ever.
How we access your tenant, what we store, how tenants are isolated, and what we cannot see. Written for a security review, not for a marketing page — and maintained alongside the product.
How we access your tenant
Read-only consent to Microsoft Graph and ARM, reviewed in your own portal. No agent, no custom role, no write scope — the product is architecturally incapable of changing your tenant.
What we never read
The contents of your storage accounts, databases, or datasets. Classification is structural — by resource type, configuration, and labeling — not by inspecting data.
Fail-closed tenant isolation
Every tenant-scoped table is protected by row-level security in the database. Isolation does not depend on application code remembering to add a filter.
Deterministic by construction
No language model sits in any reasoning, ranking, or narration path. The same estate produces the same answer twice.
Running a questionnaire? The four questions reviewers ask first are answered inline at Technology → In a security review.
The limitations list — published, not requested.
Find the reach you never granted.
A scoped assessment against your own Azure tenant. Read-only, agentless, and nothing is written to your environment — ever.
Free forever — 1 subscription, 500 identities · 30-day trial unlocks everything · No credit card
Read-only access · No agents · No log ingestion · Azure generally available