CyberProva transparency
What happens to your data
What CyberProva stores, where assessment results and evidence are hosted, and how retention and deletion work.
What we store
CyberProva stores account and workspace identifiers, connected-tenant details, assessment findings, uploaded evidence, service messages and subscription references. Findings can contain directory object identifiers and configuration observations.
- We do not ask for or store your Microsoft 365 password. Microsoft handles sign-in.
- The assessment does not request permission to read mailbox message contents or use email-message content APIs.
- Uploaded evidence and messages can contain personal or sensitive information supplied by you; remove unnecessary material before sending.
- Read the Privacy notice for categories, purposes, cookies and any enabled assistant processing.
Hosting and access
The application, database and evidence storage are hosted in Microsoft Azure UK West, in the United Kingdom. Operational logs use Azure hosting in the United Kingdom. Microsoft authentication, payments and service-email delivery involve their own providers and processing arrangements.
- Uploaded evidence is held in private storage and accessed through authorised application routes.
- UK application hosting does not mean every provider processes all information only in the UK. See the Privacy notice for transfers and safeguards.
Retention and deletion
The Privacy notice defines the retention periods for workspace data, logs, billing, correspondence and backups. Closing a workspace or making a deletion request is separate from cancelling a subscription or revoking Microsoft access.
- Request workspace deletion through the privacy contact shown in the Privacy notice. Customer workspace data may require the customer's instruction.
- The published policy provides for deletion of workspace data within 30 days, subject to specific legal retention needs.
- Database backups expire within 7 days; deleted evidence files and earlier versions are permanently removed from storage within 30 days.
- Billing and other records have separate retention periods. A deletion request does not imply immediate erasure of every backup or legally retained record.