Security & trust

TSO scans Microsoft 365 metadata to find optimization opportunities. We design and operate the platform with the following posture.

Read-only by design

• Metadata-only scanning. File contents are never read.
• No destructive actions are performed on customer tenants in v1.
• Future destructive features will be opt-in, audited, and behind feature flags.

Permissions we request

TSO uses the Microsoft admin-consent flow with application permissions. The minimum scope set:

• Sites.Read.All — SharePoint sites + libraries + file metadata.
• Files.Read.All — OneDrive + SharePoint file metadata.
• User.Read.All — owner resolution + departed-user OneDrive flagging.
• Group.Read.All — Microsoft 365 groups + Teams-backed SharePoint.
• Reports.Read.All — Mailbox / OneDrive / SharePoint usage reports (least-impact analytics).
• Directory.Read.All — Tenant baseline + license posture.

Data isolation

All customer data is partitioned by workspace ID. Server-side query helpers inject the workspace predicate into every database call. Negative isolation tests verify cross-workspace reads are impossible.

Encryption

• TLS 1.2+ everywhere (HSTS preload).
• Encryption at rest on Azure SQL (TDE) and Azure Blob.
• App-layer envelope encryption (AES-256-GCM) for sensitive small values.

Secrets

Secrets live in Azure Key Vault, accessed via managed identity. The application database stores Key Vault references, not values.

Audit

Every consent grant, billing event, scan trigger, admin change, and report download is recorded in an append-only audit log retained for seven years by default.

Data retention & deletion

Workspaces can be soft-deleted (recoverable for 30 days) or hard-deleted on request, which cascades through all stored inventory, recommendations, and exports.