Privacy Statement
Last updated 27 August 2026
Saxalar is a security monitoring service for Microsoft 365. Organisations connect their Microsoft 365 tenants to Saxalar so that we can read configuration and activity data, detect security problems, and report on them. This page explains what we read, why, where it goes, and how long we keep it.
Who we are
Saxalar operates this service. For customer data processed through it we act as a data processor: the organisation that connects a Microsoft 365 tenant is the controller and decides what we monitor. For account and billing information about that organisation, we act as a controller.
Contact: [email protected]
What we read from your Microsoft 365 tenant
Access is granted by an administrator through Microsoft's own consent screen, using Microsoft Graph application permissions. The permissions we request are read-only. We do not modify, create, or delete anything in your tenant.
We read:
- Directory objects — users, groups and membership, devices, service principals, application registrations, administrative units, domains, and directory role assignments.
- Security configuration — conditional access policies, named locations, authentication methods policies, authorisation policy, and security defaults.
- Authentication data — sign-in activity, multi-factor authentication registration state, and per-user MFA requirements. We read records of sign-ins. We never receive passwords, and we cannot authenticate as your users.
- Activity logs — directory audit logs and the Microsoft 365 unified audit log.
- Risk signals — risky users, risky service principals, and risk detections reported by Microsoft Entra ID Protection.
- Licensing — subscribed SKUs, per-user licence assignments, and subscription lifecycle dates.
- Workload configuration and usage — Exchange mailbox settings and permissions, SharePoint tenant settings, Teams and channels, and aggregate usage reporting for Teams, email, OneDrive, and Copilot.
Exchange data is collected only if an administrator separately enables PowerShell collection for that tenant. It is not part of the standard consent.
We do not read message content, file content, calendar contents, or chat contents. Where we report on mailboxes or usage, we read configuration and activity metadata, not the contents of anything.
Account information we hold about you
- Name, email address, and Microsoft object identifier for people who sign in.
- Organisation name and the tenants attached to it.
- Roles and permissions granted within Saxalar.
- Sign-in and administrative activity within Saxalar, for security and audit purposes.
How long we keep it
Retention is configurable per tenant. Where an organisation has not changed it, these defaults apply, and data older than the period is deleted automatically:
| Data | Default retention |
|---|---|
| Sign-in records | 90 days |
| Audit log records | 365 days |
| Security findings | 730 days |
| Collection run history | 30 days |
| AI assistant conversations | 90 days |
Current directory state — the present list of users, groups, devices and so on — is kept for as long as the tenant is connected, and reflects what exists in your tenant now.
Records of administrative actions taken inside Saxalar are kept as an audit trail and are not deleted on the schedule above, because their purpose is accountability.
Artificial intelligence
Saxalar uses AI to explain security findings, answer questions about your environment, and produce written summaries. To do this, relevant data — such as a finding and its supporting evidence, or the results of a query against your data — is sent to Anthropic, our AI provider.
Two things are true of that path and worth stating plainly. The AI is read-only: it can query your data but cannot change anything, and requests that ask it to make a change are refused before any query runs. And the AI never chooses whose data it sees — the scope is resolved by our servers from your permissions, before the request is made.
Who else your data reaches
| Provider | Purpose |
|---|---|
| Microsoft Azure | Hosting, storage, and databases |
| Anthropic | AI analysis and written summaries |
| Azure Communication Services | Sending notification and report emails |
We do not sell your data, and we do not use it for advertising.
Where it is stored
Customer data is stored in Microsoft Azure data centres in the United States. If your organisation requires data residency in another region, contact us before connecting a tenant.
How it is protected
- Encrypted in transit using TLS 1.2 or higher, with server identity verified.
- Encrypted at rest by the underlying Azure platform.
- The database is not reachable from the public internet by our application; it is reached over a private network path.
- The application connects to the database using a least-privilege account that cannot alter database structure or accounts.
- Every tenant's data is separated, and access is checked against your permissions on every request.
- Credentials and certificates are held in a managed secret store, not in application code.
Your choices
- Stop collection at any time by withdrawing consent in your Microsoft 365 tenant or removing the tenant from Saxalar. Collection stops immediately.
- Request deletion. Removing a tenant deletes its collected data. Ask us if you need confirmation in writing.
- Change retention for a connected tenant to a shorter period than the defaults above.
- Ask what we hold about you, and request correction or deletion, at [email protected].
Because we act as a processor for tenant data, individuals inside a customer organisation should normally raise requests with their own administrator, who controls the connection.
Changes
If we change what we collect, who processes it, or how long we keep it, we will update this page and change the date at the top. Material changes will be notified to organisation administrators.