Security & trust

Permissions — the complete list

• Microsoft Graph, delegated User.Read — the minimum needed for the consent flow to exist at all. It reads the signing-in user's own profile and basic company info. We never read your directory.
• Azure RBAC: built-in Reader, on the subscriptions you choose. This is what a scan uses.

That is the entire list. No write role, no custom role, no Key Vault access, no data-plane access to storage accounts or databases.

TenantThrift cannot change, delete, start or stop anything in your tenant. Every fix is guidance — the exact command, shown for you to review and run.

The identity that reads your tenant

Scanning authenticates with a certificate whose private key is non-exportable and never leaves our key vault — signing happens inside the vault, so there is no secret to steal from the application. Sign-in uses a separate OAuth credential, kept apart from the scanning identity.

Whatever the mechanism, the ceiling is the same: built-in Reader on the scopes you granted, revocable by you at any moment. The full architecture is on the security page.

If you grant more than Reader

Some administrators assign Contributor or Owner out of habit, or reuse an existing group. TenantThrift checks for this on every verification and every scan, and tells you: Settings → Scan scope lists each role assignment beyond Reader together with its scope, and distinguishes roles that could modify resources from ones that merely read more widely.

We ask you to remove them. The product needs Reader and nothing else, and neither of us benefits from it holding rights it never uses.

Tenant and organization isolation

Every row belongs to exactly one organization, enforced by row-level security in the database rather than by application code. A mistake in a query cannot return another organization's data, because the database refuses it.

Report PDFs live in a private bucket and are only ever served through short-lived signed URLs issued after an access check.

Sign-in security

• Microsoft sign-in inherits your Conditional Access policies — your MFA rules, your device compliance, your session limits.
• Email accounts can enable app-based two-factor authentication under Settings → Account. Once enabled it is enforced at every request, not merely at the login screen: a session that has not completed the second factor cannot reach any page or any API.
• Role checks run on the server. Hidden buttons are a courtesy; the enforcement is behind them.

Your kill switch

Delete the TenantThrift enterprise application in your tenant, or remove the Reader role assignment, and our access ends instantly. You do not need to tell us, cancel anything first, or wait for a support reply.

That is the property worth checking in any tool that reads your cloud: can you end it unilaterally, right now, from your own portal?

Hosting and subprocessors

Database, storage and processing run in the EU (Frankfurt). The DPA lists every subprocessor and is the document to hand to procurement. TenantThrift is an independent Swiss product.

Reporting a problem

Found something that looks wrong? Write to info@simonvedder.com. Security reports are read first and answered by a person.