CYBERWHITE protects your data with robust security practices
We understand M365 integration security is critical. Here's how we protect your Microsoft environment:
Authentication happens directly with Microsoft - we never see or store your Microsoft credentials. You control access through your Azure AD tenant.
CYBERWHITE only requests read-only access. We cannot modify your M365 settings, policies, or configurations - only read security scores and policy status.
We request only the minimum permissions needed: SecurityEvents.Read.All and Policy.Read.All. No access to emails, documents, or user data.
You maintain full control. Revoke CYBERWHITE's access at any time through your Azure AD portal - no data loss, just disconnection.
OAuth tokens are encrypted at rest and in transit. Tokens auto-expire and are never logged or exposed in application code.
Only Global Administrators can authorize the M365 connection, ensuring proper oversight and approval workflows in your organization.
No. We only request read-only permissions. CYBERWHITE cannot make any changes to your M365 policies, settings, or configurations.
Only authorized users in your organization. For MSPs, only assigned consultants can access client data. Data is never shared with third parties.
Data is hosted in AWS Sydney, Australia (ap-southeast-2 region) with enterprise-grade security and encryption at rest. This ensures low latency for APAC customers and compliance with Australian data sovereignty requirements.
Revoke access anytime through Azure AD Enterprise Applications or within CYBERWHITE settings. Historical assessment data remains until you delete it.
CYBERWHITE is built with SOC 2 Type II controls in mind. Contact us for our current compliance status and documentation.