Privacy Policy — dotCLOUD Assessor | dotCLOUD Consulting (Schweiz) GmbH

1 Who we are

dotCLOUD Assessor (the “Platform”) is operated by dotCLOUD Consulting (Schweiz) GmbH (“dotCLOUD”, “we”, “us”), a limited liability company incorporated under the laws of Switzerland.

Legal entity: dotCLOUD Consulting (Schweiz) GmbH
Registered office: Bahnhofstrasse 9
8952 Schlieren
Switzerland
Commercial register: CHE-450.836.600
Telephone: +41 (43) 217 80 40
General enquiries: contact@dotcloud.ch
Privacy enquiries: privacy@dotcloud.pro
Platform: assessor.dotcloud.pro

We have not appointed a statutory Data Protection Officer, as we are not required to do so under Article 37 GDPR or Article 10 of the Swiss Federal Act on Data Protection. All privacy matters are handled by the contact address given above.

2 Scope of this policy

This policy applies to the Platform at assessor.dotcloud.pro, including its public website, the customer portal, and the assessment engine that connects to a customer’s Microsoft 365 tenant. It describes our practices in respect of:

visitors to the public pages of the Platform;
individuals who submit a registration or contact request;
authorised users who sign in to the customer portal with a Microsoft 365 account; and
configuration data read from a customer’s Microsoft 365 tenant during an assessment.

It does not apply to the wider dotCLOUD corporate website, to consulting services delivered outside the Platform, or to third-party services that a customer may reach through a link.

3 Our role: controller and processor

Our role under applicable data protection law differs according to the data concerned, and the distinction matters for how rights are exercised.

Data	Our role	What that means
Account, registration and contact data of the individuals who deal with us	Controller	We decide why and how this data is processed, and you may exercise your rights against us directly.
Microsoft 365 tenant configuration data and assessment evidence	Processor	We process it only on the documented instructions of the customer organisation, which is the controller. Requests from individuals should normally be directed to that organisation.
Platform security logs and the audit ledger	Controller	Kept in our own legitimate interest in operating a secure and accountable service, and to meet our accountability obligations.

Where we act as processor, our processing is governed by a Data Processing Agreement meeting the requirements of Article 28 GDPR, which forms part of our contract with the customer and which authorised users accept within the Platform before assessments are run.

4 What we never access

The Platform assesses how a Microsoft 365 tenant is configured. It does not examine what people in that tenant write, store or say. This is a design constraint of the product, not merely a statement of policy: the permissions we request from Microsoft do not confer the ability to read the content described below, and no component of the assessment engine requests it.

We do not read, process or store:

✕The body, subject or attachments of any email in Exchange Online mailboxes.
✕The contents of files or documents held in SharePoint Online or OneDrive for Business.
✕Microsoft Teams chat messages, channel conversations, meeting recordings or transcripts.
✕Calendar entries, contacts or task content.
✕Passwords, password hashes, authentication codes, session tokens or any other credential.

What we do read is the configuration surrounding that content: whether mailbox auditing is switched on, whether external sharing is restricted, whether multi-factor authentication is registered, which policies exist and how they are scoped. Where a finding must identify an object in order to be actionable, we record its identifier or display name — for example a mailbox address, a group name or a policy name — and never its contents.

Read-only by design

Every permission the Platform uses to inspect a customer tenant is a read permission. The assessment engine contains no code path that creates, modifies or deletes an object in a customer’s Microsoft 365 tenant. It cannot change a setting, reset a password, alter a policy or send mail from a customer mailbox, and it will not do so even at the request of an administrator.

5 Categories of data we process

5.1 Registration and contact data

When an organisation applies for access, or when an enquiry is submitted through the contact form, we collect the name, business email address, organisation name, and any message text voluntarily provided, together with the time of submission and the record of acceptance of our Terms and Conditions.

5.2 Account and identity data

When an authorised user signs in with a Microsoft 365 work or school account, Microsoft Entra ID provides us with a limited set of claims from the verified identity token: the user’s object identifier, user principal name, display name, email address where present, and the directory (tenant) identifier of their organisation. We deliberately discard the profile photograph returned by Microsoft and do not store it.

The Platform has no passwords. We do not create, store, verify, reset or ever receive a password, and there is no password field anywhere in the product. Authentication is performed entirely by Microsoft.

5.3 Tenant configuration data and assessment evidence

This is the substance of an assessment. For each control evaluated, we store the outcome, a severity rating, a plain-language statement of the configuration observed, and structured evidence describing what the check actually read. Depending on the control, that evidence may include:

directory role assignments and the number and identity of privileged accounts;
Conditional Access and authentication method policies, and how they are scoped;
multi-factor authentication registration status per account — never the method secret;
mailbox configuration such as auditing status, forwarding rules and shared-mailbox sign-in state;
SharePoint, OneDrive and Teams sharing, guest-access and external-collaboration settings;
anti-spam, anti-phishing and data loss prevention policy configuration;
verified domains and their public SPF, DKIM and DMARC DNS records;
app registrations, service principals and third-party application consents.

Because directory objects belong to people, this evidence will contain personal data in the form of business identifiers — user principal names, display names and mailbox addresses of accounts in the customer’s directory. We process these solely to make findings actionable, and we cap long lists in report text rather than reproducing an entire directory.

5.4 Assessment metadata

Each assessment carries a reference number, requested scope, timestamps, progress state, the overall security score and per-severity counts, and a record of which assessment engines were reachable at the time the scan ran.

5.5 Operational and security logs

We maintain an append-only audit ledger recording privileged and consequential events: grants and withdrawals of Microsoft Graph consent, changes to a customer’s status, release of a report to a customer, edits to the remediation library, resolution of data subject requests, administrative access denials, and every administrative impersonation session. Entries record the acting identity, the affected organisation, a timestamp and relevant context.

5.6 Data subject request records

Where a request for access, erasure, portability or rectification is raised, we record the request, its type, its status, the applicable due date and the outcome.

6 Microsoft Graph permissions

An assessment is performed using application permissions granted once by a Global Administrator of the customer tenant. The complete set is set out below. It is the same list presented in the Platform’s Security & Privacy Center at the moment consent is requested, and it is generated from the same source as the assessment engine so that the two cannot diverge.

Permission	API	What it is used for
`Directory.Read.All`	Microsoft Graph	Reads users, groups and directory objects — counts Global Administrators, finds emergency access accounts and identifies guest access.
`Policy.Read.All`	Microsoft Graph	Reads Conditional Access and authentication policies to verify that legacy authentication is blocked and Security Defaults are configured correctly.
`UserAuthenticationMethod.Read.All`	Microsoft Graph	Reads which multi-factor methods users have registered. Registration data only — never a credential, secret or authentication code.
`RoleManagement.Read.Directory`	Microsoft Graph	Reads directory role assignments to report standing privilege and confirm least-privilege administration.
`SecurityEvents.Read.All`	Microsoft Graph	Reads Microsoft Defender alerts and security events to assess detection coverage.
`AuditLog.Read.All`	Microsoft Graph	Reads Entra and Microsoft 365 audit logs to confirm that logging is enabled and searchable.
`Reports.Read.All`	Microsoft Graph	Reads Microsoft 365 usage and authentication-method reports used to score identity posture.
`InformationProtectionPolicy.Read.All`	Microsoft Graph	Reads sensitivity-label policy so that data-protection controls can be assessed.
`Exchange.ManageAsApp`	Exchange Online	Runs read-only Exchange Online configuration cmdlets — mailbox auditing, mail-forwarding rules and anti-spam policy. Configuration only; message content is never read.
`SharePointTenantSettings.Read.All`	Microsoft Graph	Reads tenant-level SharePoint and OneDrive sharing settings to check external sharing limits.
`Sites.Read.All`	Microsoft Graph	Reads SharePoint site metadata and sharing configuration. Metadata only — no file contents are accessed.
`TeamSettings.Read.All`	Microsoft Graph	Reads Microsoft Teams configuration — meeting, messaging and guest-access policy.
`Organization.Read.All`	Microsoft Graph	Reads tenant profile and licensing in order to scope the assessment correctly.
`Domain.Read.All`	Microsoft Graph	Reads verified domains so that SPF, DKIM and DMARC records can be checked against real sending domains.
`Application.Read.All`	Microsoft Graph	Reads app registrations and service principals to report over-privileged or stale third-party application consent.
`AppCatalog.Read.All`	Microsoft Graph	Reads the tenant app catalogue to assess third-party application governance.

On Exchange.ManageAsApp

This permission carries a management name but is used exclusively to establish a read-only Exchange Online session so that configuration cmdlets can be executed. It is the mechanism Microsoft provides for application access to Exchange Online configuration; no cmdlet that writes, modifies or removes anything is invoked by the Platform.

Certain controls in the benchmark cannot be evaluated through any published Microsoft API. The Platform reports these openly as requiring manual review, together with the portal page or command needed to verify them, rather than silently omitting them or presenting an unverified result.

7 Sign-in and administrator consent

7.1 Sign-in

Access to the Platform is by Microsoft Entra ID only, using the OAuth 2.0 and OpenID Connect authorisation code flow with Proof Key for Code Exchange (PKCE). Sign-in takes place on Microsoft’s own domain; your credentials are never presented to, and never transit, the Platform. Sessions are maintained by an encrypted, signed, HTTP-only cookie with the Secure and SameSite attributes set. Access and refresh tokens are held server-side and are never exposed to the browser.

7.2 Administrator consent

Before any assessment can run, a Global Administrator of the customer tenant must grant tenant-wide admin consent to the permissions listed in section 6. This is a deliberate, separate act performed on Microsoft’s consent screen, which itemises the permissions independently of anything we display. The Platform records the identity of the granting administrator, the time of the grant, and the resulting consent state.

7.3 Pausing and withdrawing

An authorised administrator may pause the connection at any time from the Security & Privacy Center within the Platform, which takes effect immediately: a queued assessment that has not yet started will be cancelled rather than run. Consent may additionally be revoked entirely from the Microsoft Entra admin centre by removing the enterprise application, which terminates our access independently of the Platform.

8 Purposes and legal bases

Purpose	Data	Legal basis
Responding to a registration or contact request	Registration and contact data	Steps prior to entering into a contract (Art. 6(1)(b) GDPR); our legitimate interest in responding to business enquiries (Art. 6(1)(f))
Providing the Platform and performing assessments	Account data; tenant configuration data	Performance of a contract (Art. 6(1)(b)); processing on documented instructions of the customer as controller (Art. 28)
Producing and delivering assessment reports	Assessment evidence and metadata	Performance of a contract (Art. 6(1)(b))
Securing the Platform and maintaining accountability	Security logs and audit ledger	Legitimate interests (Art. 6(1)(f)); compliance with legal obligations (Art. 6(1)(c))
Handling data subject and compliance requests	Request records	Compliance with a legal obligation (Art. 6(1)(c))
Optional product communications	Contact details	Consent (Art. 6(1)(a)), which may be withdrawn at any time

Marketing preferences are switched off by default. We do not treat a pre-selected option as consent, and every change to a privacy preference is recorded with the time at which it was made, so that consent can be demonstrated as required by Article 7(1) GDPR.

In Switzerland, the corresponding legal bases arise under the Federal Act on Data Protection (FADP); we rely on contractual necessity, our overriding legitimate interests, statutory obligations, or consent, as applicable.

9 Where your data is stored

Platform data is stored in an Azure SQL Database and served by Azure App Service, both operated by Microsoft in the West Europe Azure region (Netherlands, European Union). Data at rest is encrypted by the platform, and all connections to and from the service are encrypted in transit using TLS.

Assessment evidence is stored in structured form against the assessment and the organisation it belongs to. Every record that belongs to a customer carries that customer’s identifier, and every query issued by the customer portal is filtered by the identity established in the server-side session — never by a value supplied by the browser.

Reports downloaded from the Platform are generated as self-contained documents that require no external resources to open. Once downloaded, they are outside our control and the customer is responsible for handling them appropriately; they contain configuration detail about the customer’s tenant.

10 Sub-processors

We keep our supply chain deliberately short. The Platform serves no third-party fonts, analytics, advertising or content delivery networks, and no third-party script executes in your browser.

Sub-processor	Service	Location
Microsoft Ireland Operations Ltd / Microsoft Corporation	Azure App Service and Azure SQL Database hosting; Microsoft Entra ID authentication; Microsoft Graph; outbound notification email	West Europe (Netherlands, EU)

We will inform customers of any intended addition or replacement of a sub-processor in accordance with our Data Processing Agreement, so that objections may be raised before the change takes effect.

11 International transfers

dotCLOUD is established in Switzerland and hosts the Platform within the European Union. Transfers of personal data from the European Economic Area or the United Kingdom to Switzerland are made on the basis of the adequacy decisions in force in respect of Switzerland.

Where support is provided by personnel of affiliated dotCLOUD entities outside Switzerland and the EEA, such access is limited to what is necessary, is subject to the same confidentiality and security obligations, is recorded in the audit ledger, and is covered by appropriate transfer safeguards including the European Commission’s Standard Contractual Clauses where required.

Microsoft’s own transfer safeguards apply to its provision of the underlying cloud services and are set out in the Microsoft Products and Services Data Protection Addendum.

12 Retention

Record	Retention period
Assessments, findings and evidence	For the duration of the customer relationship, and for 12 months thereafter unless erasure is requested sooner, so that historical posture can be compared
Account and user records	For the duration of the customer relationship
Registration requests	24 months from submission, or until the applicant asks us to remove them
Contact enquiries	24 months from the last correspondence
Audit ledger entries	Retained for the statutory limitation period. These records are held in an append-only ledger and, by design, cannot be altered or deleted
Data subject request records	Retained as evidence of compliance for the statutory limitation period

Please note

The audit ledger is a tamper-evident, append-only record. It exists so that privileged actions — including any administrative access to a customer’s view — can be proven after the fact. Consequently, entries in it cannot be erased on request. Entries record identities and actions, never the contents of a mailbox, file or conversation.

13 Security measures

We implement technical and organisational measures appropriate to the risk, including:

Identity. Authentication exclusively through Microsoft Entra ID. No passwords are held by the Platform. Administrative access additionally requires membership of the dotCLOUD directory, verified server-side on every request.
Segregation. Each customer’s data is bound to that customer’s identifier, and the data access layer resolves the applicable identity from the server-side session rather than accepting one from the client. Access across organisations is confined to a single, separately guarded administrative module.
Encryption. TLS in transit; platform encryption at rest.
Least privilege. Only read permissions are requested against customer tenants, and the scope of each is stated in section 6.
Secret handling. Credentials are supplied to the runtime as protected configuration and are never written into source control, log output, report content or command-line arguments.
Data minimisation in evidence. Checks record configuration and identifiers only. Tokens, secrets and message or file content are excluded by design.
Tamper-evident audit. Privileged actions are written to an append-only ledger.
Output encoding. All content originating from a customer directory is escaped before it is rendered on screen or written into a downloadable report.

No system can be guaranteed absolutely secure. Where a personal data breach occurs, we will notify the competent supervisory authority and affected customers without undue delay in accordance with applicable law, and in any event within the periods required by our Data Processing Agreement.

14 Administrative access and impersonation

To provide support, authorised dotCLOUD personnel can view the Platform as a customer sees it. This capability is tightly constrained:

a written business justification must be supplied before a session can begin, and it is stored with the record;
every session is written to the append-only audit ledger with the identity of the acting administrator, the organisation concerned, the justification, and the start and end times;
the session is read-only: an impersonating administrator cannot grant or withdraw consent, start an assessment, or accept legal terms on a customer’s behalf;
sessions are time-limited and are visually unmistakable within the interface.

Administrative access does not extend the permissions held against a customer’s Microsoft 365 tenant. It shows what the customer can already see within the Platform.

15 Cookies and local storage

We use only cookies that are necessary to operate the Platform securely. We do not use advertising cookies, and we do not profile visitors.

Name	Purpose	Type
Session cookie	Maintains the signed-in session after authentication with Microsoft Entra ID. Encrypted, signed, HTTP-only.	Strictly necessary
Consent state cookie	Protects the Microsoft admin consent flow against cross-site request forgery. Short-lived.	Strictly necessary
Impersonation cookie	Present only during an authorised support session; signed and server-verified.	Strictly necessary
`dc_cookie_consent`	Records your cookie choice so that you are not asked again. Stored as a cookie and in browser local storage.	Strictly necessary

You may clear these at any time through your browser. Clearing the session cookie signs you out; clearing the consent record will cause the banner to be shown again.

16 Your rights

Subject to the conditions and exceptions of applicable law, you have the right to request access to your personal data, its rectification or erasure, restriction of processing, and portability; to object to processing based on legitimate interests; and to withdraw consent where processing is based on consent, without affecting the lawfulness of processing carried out beforehand.

Authorised users may raise a request directly within the Platform’s Security & Privacy Center, which records it, allocates a reference and tracks it against a 30-day response period. Alternatively, write to privacy@dotcloud.pro.

Where we act as a processor on behalf of a customer organisation — which is the case for all Microsoft 365 tenant configuration data — we will refer your request to that organisation and assist it in responding, rather than acting on the data ourselves.

You may also lodge a complaint with a supervisory authority. In Switzerland this is the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern. In the EEA or the United Kingdom, you may complain to the authority of your habitual residence or place of work.

17 Withdrawing consent and disconnecting

A customer may disconnect the Platform from its Microsoft 365 tenant at any time, by pausing the connection within the Security & Privacy Center or by removing the enterprise application in the Microsoft Entra admin centre. Either action stops all further reading of tenant configuration immediately.

Disconnection does not by itself delete assessments already produced. To have them removed, submit an erasure request as described in section 16; we will delete the assessments, findings and evidence concerned, subject only to the audit ledger entries described in section 12.

Acceptance of the Data Processing Agreement cannot be reversed by a switch within the Platform. That agreement is the instrument which makes our processing lawful, and its termination is handled together with termination of the contract and the deletion of data, as set out in our Terms and Conditions.

18 Automated decision-making

The Platform calculates a security score from the outcome of the controls it evaluates, weighted by severity. This is a measurement of tenant configuration, not an evaluation of any individual, and it produces no legal effect concerning a person and no similarly significant effect. We do not carry out automated decision-making or profiling within the meaning of Article 22 GDPR.

19 Children

The Platform is a business service directed exclusively at organisations. It is not intended for, and is not made available to, children, and we do not knowingly collect personal data relating to them.

20 Changes to this policy

We may amend this policy from time to time to reflect changes in the Platform, in our practices, or in the law. The version and effective date are shown at the head of this document. Where a change materially affects the rights of data subjects or the scope of processing, we will notify affected customers in advance through the Platform or by email.

21 How to contact us

Privacy enquiries: privacy@dotcloud.pro
General enquiries: contact@dotcloud.ch · +41 (43) 217 80 40
By post: dotCLOUD Consulting (Schweiz) GmbH
Data Protection
Bahnhofstrasse 9
8952 Schlieren
Switzerland

We aim to acknowledge privacy enquiries within five working days and to respond substantively within 30 days.