How CyberProva protects your data

What access we ask for, and what we do with it

CyberProva reads. It has no permission to change anything in your Microsoft 365 tenant, and does not request Global Administrator as an API permission. An administrator in your organisation grants consent through Microsoft's own admin consent screen, and can withdraw it at any time from the Microsoft 365 admin centre without contacting us.

These are Microsoft Graph application permissions used for read-only automated checks. Review the permissions presented by Microsoft before granting consent. Additional checks require additional permissions and Microsoft licences; unavailable access is reported in the results.

Permissions requested by the current assessment engine

• SecurityEvents.Read.All
• User.Read.All
• RoleManagement.Read.Directory
• Application.Read.All
• Policy.Read.All
• AuditLog.Read.All

Additional permissions for advanced checks

• LicenseAssignment.Read.All
• RoleAssignmentSchedule.Read.Directory
• DeviceManagementManagedDevices.Read.All
• DeviceManagementConfiguration.Read.All
• DeviceLocalCredential.ReadBasic.All
• Directory.Read.All
• SharePointTenantSettings.Read.All
• IdentityRiskEvent.Read.All
• IdentityRiskyUser.Read.All

Permission details and how to remove access

Where a permission has not been granted, the affected check reports that plainly. It never guesses, and it never records a pass it could not establish.

Where your data lives

• The application, database and evidence files are hosted in Microsoft Azure UK West, with data at rest encrypted by the platform. Authentication, payment processing and service-email delivery use their providers’ processing arrangements; see our service provider register.
• Evidence files are held in private storage. There is no public access, and downloads are authenticated and scoped to your organisation.
• Traffic is encrypted in transit with TLS 1.2 or better. The application is served over HTTPS only, with HSTS.
• Secrets — API credentials and keys — are held in a managed secret store, not in configuration files or source control.
• Database access uses a managed identity over a private network path rather than a shared password.

Separation between organisations

Every record carries the organisation it belongs to, and every query is filtered by it. Access is controlled by role — owner, reviewer or member — and enforced on the server for every action, not just hidden in the interface. Cross-organisation access is covered by automated tests that run on every change.

What we deliberately do not collect

Our leaked-credential check reads Microsoft's own detections for your tenant. It requests the affected accounts by directory identifier and never asks Microsoft for the email addresses, because a stored list of employees whose credentials have appeared in a breach is sensitive personal data we have no need to hold.

We do not crawl the dark web, and we do not describe our checks as doing so. What we report is what Microsoft has observed for your tenant.

What we are honest about

A security product should be clear about its limits, so these are ours:

• CyberProva is not a certification body. Our assessment is not a Cyber Essentials certificate or any other formal certification.
• Automated checks verify selected Microsoft 365 settings. Other controls are supported by evidence reviewed by your organisation. CyberProva records that evidence and its review status; it does not independently verify the underlying facts.
• Assessments are periodic, not real time. Between runs, a configuration can change without us seeing it.
• No assessment can establish that an organisation has not already been compromised.