CYBERWHITE protects your data with robust security practices
We understand M365 integration security is critical. Here's how we protect your Microsoft environment:
Authentication happens directly with Microsoft - we never see or store your Microsoft credentials. You control access through your Azure AD tenant.
Security scanning uses read-only access by default. If you choose to enable automated remediation, a separate explicit consent step is required — you always see exactly what permissions are being requested.
We request only the minimum permissions needed for each function. Scanning requires only read access to security configurations. Write permissions are never granted without a separate, deliberate consent step. No access to emails, documents, or personal user data.
You maintain full control. Revoke CYBERWHITE's access at any time through your Azure AD portal - no data loss, just disconnection.
OAuth tokens are encrypted at rest and in transit. Read and write tokens are stored separately with independent expiry. Tokens are never logged or exposed in application code.
Only Global Administrators can authorize the M365 connection, ensuring proper oversight and approval workflows in your organization.
Not without your explicit permission. Security scanning is read-only by default. Automated remediation features require a separate consent step where you grant specific write permissions. You can revoke write access at any time without affecting scanning.
Only authorized users in your organization. For MSPs, only assigned consultants can access client data. Data is never shared with third parties.
Data is hosted in AWS Sydney, Australia (ap-southeast-2 region) with enterprise-grade security and encryption at rest. This ensures low latency for APAC customers and compliance with Australian data sovereignty requirements.
Revoke access anytime through Azure AD Enterprise Applications or within CYBERWHITE settings. Historical assessment data remains until you delete it.
CYBERWHITE is built with SOC 2 Type II controls in mind. Contact us for our current compliance status and documentation.