Privacy Policy

Effective date: August 24, 2026

This policy explains what TenantLookout collects, how we use it, and the controls you have. TenantLookout is operated by Tech Connect Arizona (“we”, “us”). Questions or requests: [email protected].

1. Summary

We collect two kinds of data: your account data, and security metadata about Microsoft 365 tenants you authorize us to audit.
We never read email message contents, file contents, or anything outside the five read-only permissions described below, and the connection cannot write to your tenant.
We do not sell your data and we run no advertising trackers.

2. Account data

When you register and use the site we store:

Name and business email address;
Authentication data: a hashed password (we cannot read it) or, if you sign in with Microsoft, the identifier your tenant returns; time-based one-time-password secrets and backup codes are stored only in hashed form;
If you enroll voice-call two-factor: the phone number you verify, used solely to deliver login codes;
Session records (login time, IP address, browser user-agent) kept for security review, and your security settings.

3. Tenant data we collect for audits

Connection details

When you connect a tenant we store the Entra tenant ID (a GUID), the domain you entered, your tenant’s display name and verified domains, and the connection status — nothing more is needed to keep collection running.

Audit metadata

With your administrator’s one-time consent, we collect configuration and event metadata through Microsoft Graph using exactly these read-only application permissions:

AuditLog.Read.All — sign-in and audit events (for example, sign-in times, source IP addresses and approximate locations, and success or failure), so we can flag anomalous logins;
User.Read.All — user inventory and MFA-registration status, so we can report accounts without multi-factor authentication;
MailboxSettings.Read — mailbox settings such as forwarding rules. This reads settings, never message contents;
Directory.Read.All — administrative role assignments, for privileged-access reporting;
Sites.Read.All — SharePoint site rosters and sharing-link posture, checked quarterly.

What we never collect

Email bodies, attachments, chat messages, file contents, calendar contents, or passwords from your tenant. The consented application has no write capabilities in your tenant at all.

4. How processing works

A Global Administrator of your tenant grants consent once through Microsoft’s admin-consent page. Collection then runs on a schedule using short-lived access tokens minted with our own credentials; tokens are used in memory for each run and never stored. You can end all collection instantly by removing the “TenantLookout Audit” enterprise application in your Entra admin center.

5. Why we process data (legal bases)

To provide the service you asked for (contract): running audits, producing reports, sending the alerts and digests you configure.
To operate securely (legitimate interests): account security, session records, rate limiting, abuse prevention.
Where required, we ask consent (for example, before enabling voice-call verification we verify the phone number).

For your connected tenants’ audit data, you remain the controller and we act as processor; for our website account data, we are the controller.

6. Sharing and service providers

We do not sell personal data. Findings are visible only inside your account (and to report recipients you choose). We share data only with providers needed to run the service:

Microsoft — the source of your tenant’s audit data via Graph;
Cloudflare — CDN, DNS, and secure tunnel fronting the site (network metadata such as IP addresses);
Email delivery — transactional email (verification, password reset, reports and weekly digests) is sent from [email protected] through mail infrastructure we operate, hosted with Akamai/Linode;
Twilio — only if you enroll voice-call two-factor, to place code-delivery calls to your verified number;
Payment processing (when billing activates) will be handled by Stripe; card numbers never touch our servers.

We may disclose information if required by law, or to protect rights, property, or safety, in which case we limit what we disclose.

7. Cookies

We use strictly necessary cookies only: a session cookie to keep you signed in, short-lived cookies during two-factor challenges, and an optional “trusted device” cookie (30 days) if you choose that option at login. We set no advertising or analytics cookies today; if we ever add optional analytics, this policy and a consent prompt will govern first.

8. Retention

Raw collected audit data is retained up to 90 days, then deleted;
Summarized findings are retained while your account is active;
Connection and account records are retained until you disconnect the tenant or request deletion (we keep minimal audit-trail records of connection events);
Backups roll off on their normal cycle after deletion requests are honored.

9. Security

TLS everywhere between your browser, our edge, and Microsoft;
Passwords hashed (scrypt); second factors and backup codes stored hashed;
Least-privilege, read-only API scopes; per-run tokens held in memory only;
Rate limiting on authentication endpoints and layered input sanitization;
Report artifacts served only through authenticated, ownership-checked views.

No system is perfectly secure; we design to make meaningful compromise hard and detectable, and we will notify affected customers of any confirmed breach of their data as required by law.

10. Your rights and choices

Wherever you live, you may ask us to: export, correct, or delete your account data; tell you what tenant data we hold for you; or disconnect a tenant (which stops collection immediately). Contact [email protected]. EU/UK users have the rights described in GDPR (access, rectification, erasure, restriction, portability, objection, and complaint to your supervisory authority). California residents: we do not sell or “share” personal information as defined by the CCPA/CPRA. We aim to respond within 30 days.

11. International transfers

The service is operated from the United States. If you use it from elsewhere, your data will be processed in the US; where required, transfers rely on appropriate safeguards such as standard contractual clauses.

12. Children

TenantLookout is a business product and is not directed to anyone under 16. We do not knowingly collect data from children under 16; contact us to remove any such data.

13. Changes to this policy

We will post any change here and update the effective date. Material changes affecting how we process your data will be emailed to account holders in advance, and re-acceptance may be requested before paid checkout activates.

14. Contact

Tech Connect Arizona · [email protected] · or via our contact page.