This document is intended for security teams, IT procurement reviewers, and information governance officers assessing M365Clarity for use within their organisation. It covers data access, storage, security controls, compliance, and operational practices.
M365Clarity requests read-only access to the following Microsoft Graph API scopes. It cannot read, modify, or delete any data in your tenant.
User.Read — authenticated admin account name and emailOrganization.Read.All — tenant name and licence subscriptionsReports.Read.All — aggregated usage and activity reports (anonymised by Microsoft)SecurityEvents.Read.All — Secure Score and security alert countsPolicy.Read.All — Conditional Access and other policy configurationsDirectory.Read.All — directory settings and group configurationsServiceMessage.Read.All — Microsoft 365 service announcementsSites.Read.All — SharePoint site metadata (storage, activity) — no file contentM365Clarity does not access: email content, file content, Teams messages, calendar events, OneDrive files, or any user-generated content.
All data is stored in Cloudflare D1 (SQLite) in the WEUR region (Amsterdam, Netherlands). No data is replicated outside the European Union. Processing runs on Cloudflare Workers at the same edge location. Cloudflare's infrastructure is ISO 27001 certified and SOC 2 Type II compliant.
M365Clarity Limited is a UK-registered company (Company No. 17208567). Data storage within the EU means processing is covered by the EU GDPR and UK GDPR adequacy framework.
Microsoft OAuth access and refresh tokens are encrypted with AES-256-GCM before being written to the database. The encryption key is stored separately using Cloudflare Workers Secrets — never logged or exposed in application code. Tokens are decrypted only at scan time, in memory, and are never written to logs, caches, or external services.
All data in transit is encrypted using TLS 1.2 or higher. Cloudflare D1 data at rest is encrypted by Cloudflare's infrastructure.
M365Clarity uses Microsoft OAuth 2.0 (delegated permissions) for tenant connections. User sessions are managed via server-side session tokens stored in Cloudflare KV with a 7-day TTL. Session tokens are passed as Bearer tokens in the Authorization header — never in cookies or query strings.
All API routes validate the session token server-side on every request. Rate limiting is applied to all user-callable endpoints at the Cloudflare edge. Production infrastructure access requires multi-factor authentication.
Scan data is scoped to the authenticated user account that connected the tenant. No other M365Clarity customer can access your data. M365Clarity team members do not have routine access to customer scan data — production database access requires explicit authorisation and is logged in the audit trail.
Optional viewer access can be granted by the account owner to named email addresses. Viewers have read-only access to scan results and cannot trigger scans, modify settings, or access billing information.
No scan data is shared with any sub-processor beyond what is necessary to deliver the service.
All retention periods are enforced by an automated scheduled process. No manual step is required.
Yes. M365Clarity Limited is registered with the UK Information Commissioner's Office (ICO registration number ZC173030) and complies with UK GDPR. Data is stored in the EU (Amsterdam) and processed under standard contractual clauses where applicable.
Users can export all their data as JSON, request deletion, or disconnect their tenant at any time from within the application. The right to erasure is fulfilled within 30 days via an automated deletion process. M365Clarity does not store IP addresses.
Microsoft requires a Global Administrator to grant tenant-wide consent for delegated permissions that apply across the organisation. This is a Microsoft requirement, not an M365Clarity design decision. Granting consent does not give M365Clarity any administrative access — it only allows read-only API calls.
After consent is granted, the connected account does not need to retain the Global Administrator role. The SharePoint Administrator role is additionally required for SharePoint site data.
No. All Microsoft Graph API permissions are read-only. M365Clarity cannot create, modify, or delete any resource in your tenant — it cannot send emails, change policies, create users, modify group memberships, or alter any configuration. This is enforced at the permission scope level by Microsoft.
M365Clarity has not yet undergone a formal third-party penetration test. The infrastructure layer (Cloudflare) is ISO 27001 certified and SOC 2 Type II compliant. The application layer follows OWASP security principles: all database queries use parameterised bindings, all API routes validate session tokens server-side, user data is scoped per account with no cross-tenant access, and all external API calls are made over HTTPS with enforced timeouts.
To discuss security questionnaires or testing requirements, contact support@m365clarity.com.
In the event of a confirmed data breach affecting personal data:
To report a suspected security vulnerability: support@m365clarity.com — subject line "Security Issue".
M365Clarity runs on Cloudflare Workers and D1, which benefit from Cloudflare's global network with a 99.9% infrastructure SLA. M365Clarity does not currently offer a formal application-level SLA to customers. Scheduled scans and AI features depend on Microsoft Graph API and Anthropic API availability — temporary unavailability of these services is handled gracefully, failing cleanly rather than producing incorrect results.