Built so that read-only is a constraint, not a claim

Microsoft Graph: read-scoped

Every Graph permission in the scanner’s manifest is read-scoped. No .Write, .ReadWrite or .Send scope exists in the set, and no Mail.Read: the scanner holds no permission that can read message content. Your Global Administrator can verify the whole list on the consent screen before approving anything.

Exchange Online: contained twice

Microsoft offers no read-only app-only Exchange permission, so Exchange.ManageAsApp is the only option that exists. It grants nothing by itself: its capability is set by the directory role you assign, and ScanPosture asks for the read-only Global Reader role. In operation the engine’s Exchange path only ever issues read (Get-) commands.

SharePoint sharing settings: isolated

The tenant-wide sharing settings two checks assess are exposed by no read-only permission. Rather than widen the scanner, the broad scope is quarantined in a separate certificate-backed collector app the scanner never holds, calling exactly one read endpoint. Consent to it is optional and separate.

Access is itemised and optional

Admin consent alone runs 185 of the 201 checks. The read-only role assignments add 14 more, and the collector adds the final 2. Decline any of it and the affected checks are surfaced as skipped with a documented reason, never as failed, and never as a silent pass.

Authentication

• Email + password sign-in via NextAuth, with email verification on signup.
• Mandatory multi-factor authentication using a TOTP authenticator app, with single-use backup codes issued at setup.
• Sign-in protected by Cloudflare Turnstile to mitigate credential-stuffing.
• Password rotation reminders via a daily expiry-warning job.

Authorisation and access control

• Tenant isolation is enforced inside the database, not just in application code. One customer can’t read another’s data even if a query is malformed or the app has a bug.
• Customer roles: owner, admin, analyst, billing, viewer, each with explicit capability scopes.
• ScanPosture staff sign in through separate accounts; access to a customer tenant for support is exceptional, recorded against the staff identity, and appended to a tamper-evident audit log visible to that customer.

Audit and integrity

• Every administrative event, tenant-context action and read of sensitive resources is appended to a hash-chained audit log.
• A daily integrity job re-computes the hash chain across the whole log; any tampering detaches the chain and surfaces immediately.
• Audit retention runs as scheduled jobs, activity logs and MSP audit records are retained per-policy and pruned on a monthly cycle.

Data protection in transit and at rest

• All HTTP traffic is served over TLS 1.2+ via Vercel’s edge.
• Customer data at rest is encrypted by Supabase at the storage layer (AES-256).
• Secrets and customer-tenant connection material are encrypted at the application layer before being written to the database.
• Strict, nonce-based Content-Security-Policy applied per request to every authenticated route.

What we read from your tenant

• Microsoft Graph and Exchange Online, read-scoped as set out in the read-only model above. The full per-scope list, including what each scope does not grant, is on the permissions page.
• Two optional Azure-resource checks use the built-in read-only Reader role at the tenant root, granted manually by your administrator if you want them included.
• No customer credentials, mailbox content or document content is fetched. ScanPosture reads configuration metadata to assess posture, not user data.

Data retention and deletion

• Customer accounts and data are retained while a tenant is active.
• On cancellation a soft-delete is applied; a daily hard-delete job permanently removes soft-deleted records on a fixed schedule.
• Activity logs and access-review records run on their own retention cycles, defined in code and applied by scheduled jobs, not manual processes.

Operational visibility

• Live operational status, 30-day uptime history and incident timeline at status.scanposture.com.
• Subscribe to email or Atom feed updates for incidents, opened, updated and resolved notifications only, never marketing.
• Maintenance windows are announced on the status page in advance.

Logging and monitoring

• Application errors and exceptions are captured by Sentry with stack traces, deploy version and request context.
• Request and function-execution logs are retained by Vercel; database access logs are retained by Supabase.
• Alerts route to the on-call team for unhandled exceptions and anomalous error rates.
• No customer credentials, secrets or sensitive payloads are written to logs by design, server-side scrubbing applied at the boundary.