Data & Privacy

Data & Privacy

Our commitment to data privacy and security with minimal data storage and no data leaving your tenant

Data & Privacy

Intune Assistant is built with privacy by design. The core principle is that your data stays in your tenant - everything is processed in session memory and stored only the absolute minimum required for licensing and identification.

Our Privacy Commitment

Zero Data Extraction

No data leaves your tenant. All Intune and Graph API data is processed in browser session memory only and never stored or transmitted to external systems.

Data Storage & Processing Overview

Minimal Data Storage Approach

There is a very strict minimal data storage policy with complete transparency about what is stored and why:

Data Type	Stored	Purpose	Retention
Tenant ID	✅ Yes	Identify tenant and enforce fair-usage licensing. (Access can be denied by Tenant ID)	Persistent
Tenant Domain	✅ Yes	Display and licensing identification	Persistent
Session Data (tokens, settings)	❌ No	Stored only in browser session storage	Temporary
Intune Data	⚠️ Only with a paid module	The free edition processes Intune data in memory only (the Tenant Overview is kept in server memory for 10 minutes, never in the database). Modules that need history (for example Configuration Management and Assignments Manager) store the data they need for that feature. The full per-table classification is being completed (IA-AUDIT-021)	Per module; being defined
Graph API Data	⚠️ Only with a paid module	See above. Stored Tenant Overview content (snapshot and change history) exists only for tenants with an active Configuration Management entitlement	Snapshot replaced every collection; change history 90 days
User's Device Information	❌ No	Never accessed or stored	N/A
User Personal Data	❌ No	Never accessed or stored	N/A

What is stored per feature

The free edition stores only onboarding and licensing data (your organization, tenant identifiers, licenses and consent), the people who use the app, and an audit trail of actions in the app. Tenant content (the Tenant Overview snapshot and change history, settings usage, Assignments Manager sessions) is stored only for tenants that use the module which needs it. Worker job history keeps status, counts and stage-level errors for 90 days, never per-device results, stack traces or recipient addresses.

How We Process Your Data

Data Flow Principles

1

Request Processing

• API calls made directly to your tenant's Graph API
• Data retrieved and processed in memory only
• Results displayed immediately to your browser

2

No Persistence

• API responses processed and immediately discarded
• No database storage of any tenant-specific data
• No caching beyond browser session storage

3

Session Management

• Authentication tokens stored only in browser session
• Session data cleared automatically on logout
• No server-side session persistence

Browser session storage is used for temporary data like UI preferences and navigation state. This data is automatically cleared when you go to another page, close your browser or log out.

Data Security Measures

Technical Safeguards

• HTTPS Encryption - All communications encrypted in transit
• No Database Storage - No persistent storage of tenant data, except tenant Id and tenant domain
• Memory-Only Processing - All operations performed in volatile memory
• Automatic Cleanup - Memory cleared after each operation
• Session Isolation - Each session completely isolated from others

Access Controls

• Microsoft Identity - Authentication through your tenant's identity provider
• GDAP Compliance - Granular delegated admin privileges for MSPs
• Role-Based Access - Permissions enforced through your tenant's RBAC
• No Backdoors - No administrative access to your tenant data

Compliance Standards

• GDPR Compliant - Privacy by design approach
• Microsoft Security Standards - Built on Microsoft's security framework
• Industry Best Practices - Following established security guidelines
• Regular Security Reviews - Continuous security assessment and improvement

MSP Privacy Considerations

Multi-Tenant Data Isolation

For MSP environments, we ensure complete data isolation:

• Tenant-Specific Processing - Each customer tenant processed independently
• No Cross-Tenant Data - No mixing of data between customer tenants
• GDAP Respect - Only access data according to granted permissions

Customer Data Protection

• Customer Consent - All access based on explicit GDAP permissions
• Limited Scope - Only access data necessary for granted roles
• No Data Sharing - No sharing of customer data between tenants or MSPs

Your Rights and Controls

Data Control

• Full Control - You maintain complete control over your tenant data
• Access Management - Control application access through Azure AD
• Permission Granularity - Grant only necessary permissions
• Revoke Access - Instantly revoke application access at any time

Transparency

• Open Source - Application code (Webinterface) available for review
• Clear Documentation - Complete transparency about data handling
• No Hidden Processes - All data processing clearly documented
• Regular Updates - Privacy policy updates communicated clearly

Technical Questions

How do you handle authentication tokens?

Authentication tokens are stored only in your browser's session storage and are never transmitted to our servers or stored persistently.

Is my data encrypted?

All communication is encrypted via HTTPS. Since we don't store your data, there's no data at rest to encrypt.

Can other users see my data?

No, all data processing is isolated per user session. No data is shared between users or stored centrally.

---

Privacy Promise

Your data stays with you. We're committed to keeping your Microsoft tenant data exactly where it belongs - in your tenant, under your control.

---

Leaving Intune Assistant

When you stop using Intune Assistant, ask us to offboard your organization. We export the data we store for your tenants if you want a copy, then remove it together with your tenant links, licenses and Worker data. The audit trail of actions in the app and the minimal licensing record (customer and tenant identifiers) are kept. An offboarded organization is not reactivated automatically by granting consent again.