Trust & security
Connect with your eyes open.
Connecting Microsoft 365 is a one-way trust decision, so here is precisely what Presight does with your tenant — the permissions, the data, and the limits.
The permissions we request
Presight uses an app-only, admin-consented Microsoft Graph connection. Every permission below is read-only — we request no write permission of any kind. Microsoft shows you this exact list on the consent screen before you approve; nothing is granted until you consent.
Organization.Read.AllConfirm the connection: your tenant's organisation profile and verified domains.Directory.Read.AllRead licences and subscriptions, directory roles, and the service principals and OAuth grants behind the non-human-identity inventory.SecurityEvents.Read.AllRead Microsoft Secure Score and its control profiles.Policy.Read.AllRead Conditional Access and security-defaults policy for the identity signals.AuditLog.Read.AllRead last sign-in activity to flag dormant accounts and consented apps.The deeper signals (policies, audit logs) are optional. If they are not consented, that part of the dashboard simply shows nothing rather than failing — and nothing is ever written back.
No customer credentials stored
We never hold your administrator credentials. There is no per-tenant secret or refresh token in our database — we store only your tenant ID and the read-only data we fetch. That removes an entire category of breach: there is nothing of yours in our database to steal.
Where your data lives & how long we keep it
Your tenant data is processed to produce your scores, tasks and reports, and is retained only while your account is active. On cancellation we delete your tenant data, and you can revoke Presight at any time by removing the enterprise application from your Microsoft 365 tenant — which immediately ends all access.
Passwords never leave your device
The breached-password check uses k-anonymity: your browser hashes the candidate password with SHA-1 and sends only the first five hex characters of that hash to the public Have I Been Pwned range API. The password — and its full hash — never reach our servers.
The scoring model is published
Posture (higher is better) and exposure (lower is better) are computed from published, versioned weights, so you can always answer “where did this number come from?”. Findings are mapped to NIST CSF 2.0, CIS Controls IG1, King V and POPIA.
Sub-processors & AI
We keep the sub-processor list (hosting, email delivery and PDF rendering) short and current. Any AI-generated explanation is used only to phrase findings in plain language; your data is not used to train third-party models.
Reporting a security issue
Found something? Email security@presight.co.za. We welcome responsible disclosure and will acknowledge your report.