AZClarity requests a single delegated, read-only Azure Resource Manager scope:
https://management.azure.com/user_impersonation — acts as the signed-in user, limited to what that user can already readoffline_access — allows the token to be refreshed so scheduled scans can runopenid, profile, email — sign-in identity onlyAZClarity reads resource configuration and inventory metadata: resource types, counts, regions, SKUs, tags, policy assignments, budgets, security posture settings (Defender plans, Secure Score), and Azure Advisor recommendations.
AZClarity does not access the contents of your resources. It cannot read data inside your storage accounts, databases, key vaults, virtual machines, or any application data. It reads the shape of your estate, not what is in it.
No. AZClarity is architecturally incapable of writing to your Azure environment.
The only permission it holds is user_impersonation against the Azure Resource Manager API, exercised through read-only API calls (GET requests and Resource Graph queries). It never issues a create, update, or delete operation, and it holds no Contributor or Owner role anywhere.
For MSP client tenants, AZClarity's service principal is granted the built-in Reader role — an Azure role that cannot perform write operations, enforced by Azure itself rather than by our code.
All data is stored in Cloudflare D1 (a managed SQLite service), provisioned in the Western Europe (WEUR) region. Application logic runs on Cloudflare Workers. Session tokens are held in Cloudflare KV with a 30-day expiry.
No customer data is stored on servers operated directly by AZClarity — there is no self-managed infrastructure to compromise. Cloudflare is ISO 27001 and SOC 2 Type II certified.
Azure OAuth tokens (access and refresh) are encrypted at rest using AES-256-GCM, an authenticated encryption mode, with a unique random initialisation vector per value. The encryption key is held as a Cloudflare Worker secret and is never present in source control.
Personally identifiable fields (organisation name, domain, client-tenant names) are additionally encrypted at rest using a per-tenant key, derived via HKDF-SHA256 from a secret pepper salted with the tenant's own identifier. Each customer's data is therefore encrypted under a different key: compromising one tenant's records does not expose another's.
Tokens and secrets are never written to logs, never returned in API responses, and never included in error messages.
There are two sign-in paths, and neither involves AZClarity storing a password — we never handle, store, or transmit passwords.
Sessions are bearer tokens held in browser sessionStorage with a 30-day server-side expiry. Subscription status is re-validated against the database on every paid request, so access is revoked immediately on cancellation rather than persisting until the session expires.
Every database query is scoped to the user or organisation identifier taken from the authenticated session — never from a URL or request parameter. It is not possible for one customer to read, modify, or even confirm the existence of another customer's data by manipulating a request.
On the MSP plan, data is scoped to the organisation: members see their own organisation's connected client tenants, and destructive actions (removing a client tenant, removing a member) require an owner or administrator role.
Administrative access: a single administrator account exists for platform support. Its dashboard is protected by an email allow-list and a step-up second factor (an emailed six-digit code exchanged for a 60-minute token) for any high-risk action. Administrative actions are recorded in an audit log.
No data is sold, shared with advertisers, or used for any purpose other than delivering the service to you.
Scan results are retained while your account is active, so that historical trends and change detection remain available. You can delete a connected subscription at any time from within the application, which removes its associated scan data.
On account deletion, all associated data — scan results, subscriptions, encrypted tokens, and organisation records — is deleted within 30 days, and any active Stripe subscription is cancelled. Requests to support@azclarity.com with the subject "Data deletion request".
Yes. AZClarity is registered with the UK Information Commissioner's Office (ICO registration ZC173030).
The personal data processed is minimal: the name and email address of the signed-in user, and — for MSP organisations — the names and email addresses of invited team members. No end-user personal data from your Azure estate is collected, because AZClarity reads infrastructure configuration rather than application content.
Controller/processor roles: for a standard account, AZClarity is the data controller for your account details. For the MSP plan, where an MSP connects a client's Azure tenant, the MSP is the data controller for that client's data and AZClarity acts as a data processor on the MSP's instructions. The MSP is responsible for having an appropriate lawful basis and agreement with their client.
You may exercise your rights of access, rectification, erasure, and portability at any time by emailing support@azclarity.com.
This is worth stating plainly because it is often misunderstood. Azure does not offer a one-click, tenant-wide grant equivalent to Microsoft Graph's admin consent. Reading an Azure subscription always requires an explicit role assignment.
Connecting a client tenant therefore requires two deliberate actions by the client:
The client retains full control and can revoke either at any time from the Azure portal, immediately terminating AZClarity's access. AZClarity holds no standing access that the client cannot see and remove.
state parameter held server-side.We will not overstate this. AZClarity has not undergone a formal third-party penetration test or a SOC 2 audit. It is an independently operated product, and we would rather tell you that plainly than imply a certification we do not hold.
What we do have: a documented internal security audit covering authentication, authorisation, multi-tenant isolation, injection, secrets handling, and cost-abuse controls; a mandatory secure-by-design review for every change; and automated type-checking and schema verification in the deployment pipeline. Underlying infrastructure (Cloudflare) is ISO 27001 and SOC 2 Type II certified.
If a formal assessment is a condition of your approval, contact security@azclarity.com to discuss it.
In the event of a personal data breach, AZClarity will notify the UK Information Commissioner's Office within 72 hours of becoming aware of it, as required by UK GDPR, and will notify affected customers without undue delay where the breach is likely to result in a high risk to their rights and freedoms.
Notification will describe what happened, the data categories affected, the likely consequences, and the measures taken. Security concerns can be reported directly to security@azclarity.com.
AZClarity runs on Cloudflare's global edge network, which provides inherent redundancy and DDoS protection. There is no single server whose failure takes the service offline.
We publish no contractual SLA, and we will not invent one. AZClarity is an assessment and reporting tool, not a production dependency: an outage means you cannot run a scan or view a report for a period. It does not affect the availability, security, or operation of your Azure environment in any way. Nothing in your estate depends on AZClarity being up.
Data is stored in Cloudflare D1, which provides managed durability and backup at the platform level.