&License
Sample report How it works Pricing For MSPs Security
Sign in Connect and see your number
Security review

Everything your security team will ask, answered before they ask it.

We are asking a Global Admin for a read of your directory. That deserves a page you can forward without editing, so this is it — scopes, storage, retention, subprocessors and how to revoke.
Access model
Read-only by default
Content access
None, ever
Data region
United States
Encryption
TLS 1.3 / AES-256
Retention
13 months, then rolling delete
Deletion
Within 7 days, self-serve
SOC 2 Type II
In progress — report expected Q4 2026
Scopes requested
Six, all listed
What we store
User identifiers, display names and account status
License and SKU assignments, and purchase quantities
Sign-in timestamps — the time, not the event contents
Aggregate feature usage counters per product
App names and OAuth grant metadata
Spend records: vendor, amount, date, from the sources you connect
What we never store
Email, messages, files, documents or attachments
Calendar contents or meeting bodies
Passwords or password hashes from your tenant
MFA secrets or device certificates
Payment card numbers — spend sources are read via API, tokenized
Anything from a tenant you have not connected
Controls
Where the data lives
All data is held in US-based infrastructure. Nothing is replicated outside the region, and we do not use customer data to train models.
Primary: AWS us-east-1 · Backups: us-west-2
Encryption
TLS 1.3 in transit, AES-256 at rest, including backups. OAuth refresh tokens are held in a dedicated KMS-encrypted store.
Keys rotated every 90 days
Retention
We keep 13 months of history so trend lines and renewal comparisons work. Older snapshots are deleted on a rolling basis.
Rolling delete runs nightly
Access on our side
Least privilege, SSO with hardware keys, and no standing production access. Break-glass access is time-boxed and logged.
Every access event is auditable on request
Tenant isolation
Each connected tenant is scoped and queryable only by the account that connected it. MSP portfolio views are aggregates for that MSP account only.
Deletion
Delete your workspace from company settings and stored metadata is removed within 7 days, backups included. We confirm in writing.
No retention hold, no exit fee
Every scope, in plain language
Six read-only permissions on Microsoft 365, six on Google Workspace, and a separate, optional set for write actions you turn on yourself. Each one is listed with what it returns and why we need it.
See the scope list
Certifications and posture
SOC 2 Type II
In progress
Observation window opened March 2026. Report expected Q4 2026. We will not claim it before the auditor signs.
GDPR
Compliant
DPA available on request, standard contractual clauses in place, EU representative appointed.
HIPAA
BAA available
We do not process PHI. If your tenant is a covered entity, we will sign a BAA.
Penetration test
Annual
Third-party application and cloud test, February 2026. Summary letter available under NDA.
Subprocessors
The complete list. We give 30 days' notice before adding one, and you can object.
Subprocessor
Purpose
Region
Amazon Web Services
Application hosting and encrypted storage
United States
Managed Postgres
Tenant metadata storage
United States
Stripe
Subscription billing — no card data touches us
United States
Postmark
Transactional email — alerts and reports
United States
Anthropic
Recommendation summaries. Zero-retention endpoint, metadata only.
United States
&License
See what you're paying for that nobody uses. Read-only, connected in minutes, priced per user.
Built by the team that runs a 100+ person MSP.
Product
Overview Sample report How it works Pricing
For MSPs
MSP overview Portfolio view MSP pricing
Trust
Security review Scopes we request Data handling Sign in
© 2026 &License.
Security Privacy Terms