Security & privacy

What we store

• AI usage metadata: model, provider, tokens, latency, date, team/application tag.
• The people directory you import: email, name, department, manager, country, cost center.
• AI license assignments and their last activity.
• Calculated footprint (energy, CO₂e, water) and the calculation engine applied.
• Audit logs of sensitive actions (who did what, and when).

What we do NOT store

• We do not store prompts. The content of requests passing through the gateway is never persisted.
• We do not store model responses.
• We do not store documents or files from your Microsoft 365 — only directory, licenses and usage reports.

Credentials & tokens

• Your provider API keys (OpenAI, Anthropic…) are encrypted at rest (Fernet/AES) and never displayed once saved.
• Microsoft OAuth tokens are encrypted with the same scheme.
• You can rotate or revoke credentials and gateway keys at any time from Settings.

Microsoft Graph permissions

The connector uses read-only permissions under least privilege: read users and directory, read licenses, read usage reports. Each permission is explained in the connection wizard before admin consent, and you can disconnect the tenant and delete imported data at any time.

Authentication & access

• Passwords hashed with scrypt and salt; signed sessions with HttpOnly/SameSite cookies.
• Rate limiting on login and registration.
• Per-organization roles: Owner, Admin, Analyst, Viewer, Developer.
• Microsoft login and mandatory SSO on the Govern plan (rolling out).

Application hardening

• Forced HTTPS (Let’s Encrypt) with HSTS in production; encrypted transport end to end.
• Security headers on every response: Content-Security-Policy, anti-clickjacking (X-Frame-Options / frame-ancestors), nosniff and a strict referrer policy.
• CSRF protection by origin verification, combined with signed SameSite session cookies.
• The API schema is not exposed publicly (no docs, no OpenAPI endpoint).
• Strict multi-tenant isolation: every query is filtered by organization; one customer can never see another’s data.

Your data, your control

GDPR-ready principles: data minimization (metadata only by default), right to erasure (per-organization deletion on request), methodology transparency. DPA available for Enterprise customers. We do not claim certifications (SOC 2, ISO 27001) we do not yet hold.