SCOUTz Microsoft 365 Review application — Privacy Statement

What we collect from your tenant

Configuration and metadata only: user account attributes (name, user principal name, job title, department, account state, licence assignment, sign-in method registration, administrative roles), group and role membership, enterprise application registrations and the permissions granted to them, tenant policies (conditional access, authentication methods, consent, sharing settings), device records (join type, operating system build, compliance state), licence inventory, usage report aggregates, security recommendations and alerts issued by Microsoft, and directory synchronisation status.

What we do not collect

The content of mail, documents, files, chats, meetings or Copilot interactions; passwords or authentication secrets; anything requiring a permission classified as content. The application cannot obtain these even if offered.

Why we collect it

To produce a read-only security review for your managed service provider, who uses it to advise you.

Who sees it

Your provider, through the SCOUTz portal, isolated to their organisation by database row-level security. SCOUTz platform operators, only for support and only under audit. Client-facing reports do not carry account identifiers by default; your provider may choose to include them in reports they issue to you.

How long we keep it

Review findings: 30 days after the review completes, then deletion, unless your provider pins the review as a baseline. Consent, revocation and review activity records: kept permanently in an append-only log (acting identity, email address, source IP address, action, outcome — no tenant data, no findings), so the record that your data was read cannot be erased. See section 10.4 of the Data Processing Addendum.

Where we keep it

In the United States, on infrastructure operated by Railway Corporation.

Sub-processors

As listed in the Terms of Use above.

Your rights

You can revoke access at any time, ask your provider to delete a review before the 30 days elapse, and ask what was read on any review; every review carries a coverage record listing each area read, not read, or refused. Requests: privacy@scoutzsecurity.io.

Contact

SCOUTz LLC, privacy@scoutzsecurity.io, c/o Republic Registered Agent LLC, 3101 N. Central Ave, Ste 183, Phoenix, AZ 85012.