Client data

1. What is collected

Read-only configuration and identity data through Microsoft Graph: accounts, groups, roles, PIM and Conditional Access policies, authentication methods, applications and service principals, OAuth grants, Intune devices with their compliance and configuration, Windows LAPS metadata, sign-in and audit logs, risk data and licence SKUs.

Not collected: mailbox or file content, Teams messages, or documents. LAPS collection records whether a password is backed up, never the password.

The free scan collects configuration data only, run by your administrator; you review the output before sending it.

2. Where it is stored

In TrogSec's own Azure subscription, West US 2. Each collection is signed and held write-once for your agreed retention period; not even TrogSec can alter or delete it.

Reports go to named contacts by encrypted email through Microsoft 365, and are never stored on the client portal.

3. Who processes it

Microsoft

Azure hosts the pipeline, evidence and reports; Microsoft 365 sends reports.

Frappe Cloud

Hosts the client portal (portal.trogsec.com): contacts, tickets and change requests only. No collected data or reports.

No other party processes your identity data. Your tenant data, scan output and reports never go through an AI tool, by us or anyone we use, not even for drafting notes. This is contractual.

4. How long it is kept

Write-once, for your agreed retention period. Evidence can outlast the engagement and cannot be deleted early, which is what an auditor revisiting a past cycle needs.

5. How access ends

Collection runs through one read-only application in your tenant, using managed-identity federation: no password, secret or certificate to revoke. At offboarding you remove the application and collection stops. Microsoft keeps a deleted application restorable for 30 days.

The permission list and the remediation change record remain yours.