Security

How AZClarity protects your Azure subscription data

Read-only by design. AZClarity is a feature-adoption and visibility tool, not a security or compliance product — it reports on your Azure estate and never modifies it. Need to brief your own security team? A ready-made, copy-paste security brief is in the Help & FAQ under “For your security team.” AZClarity requests only read permissions on your Azure subscription. We cannot create, modify, or delete any Azure resource. This is enforced at the OAuth scope level — not just a policy.

Azure permissions

AZClarity uses Microsoft Entra ID (Azure AD) OAuth with the user_impersonation scope for Azure Resource Manager. This grants read-only access equivalent to the built-in Reader role. The specific permissions used are:

Resource Graph — list resources by type and region
Subscriptions — list subscriptions in your tenant
Cost Management — read spending data (if available)
Security — read Defender for Cloud plan status
Network — read VNet and NSG configuration for security assessment
Authorization — read role assignments (count only, no identity data)

You can revoke AZClarity's access at any time from Microsoft Entra ID → Enterprise applications in the Azure portal. Revoking access immediately invalidates all stored tokens.

Token storage

Azure OAuth access and refresh tokens are encrypted at rest using AES-256-GCM before being written to our database. Each token uses a unique randomly-generated IV. Encryption keys are stored as Cloudflare Worker secrets — separate from the database, never logged.

Tenant isolation

Every database query is scoped to your user ID, derived from your authenticated session token. It is not possible for one customer to access another customer's scan data, subscriptions, or AI results. This is enforced at the query level — not just through UI restrictions.

AI security

When generating AI observations, AZClarity:

Never sends your email address, your name or your Azure access tokens to Anthropic. Subscription and network names, and any text you type into What If chat, are sent as written (see the Privacy Policy, section 5)
Sanitises resource names to prevent prompt injection attacks
Generated analyses use an allowlist of permitted analysis types. The What If chat takes free text from you; its instructions restrict it to Azure questions about the selected subscription
Removes email addresses, GUIDs and key-like strings from AI output before returning it. Cross-tenant isolation comes from the per-user database scoping above, since each AI request is built only from your own scan data
Limits AI calls to 10 per user per day to prevent abuse

Infrastructure

Hosting: Cloudflare Workers (edge compute, global network)
Database: Cloudflare D1 — European Union jurisdiction
Sessions: Cloudflare KV with 30-day expiry
TLS: Enforced on all connections — HTTPS only, HSTS enabled
DDoS protection: Cloudflare network-level protection

Rate limiting

Authentication: 20 attempts per hour per IP
Scans: 5 per subscription per day
AI calls: 10 per user per day
All API endpoints rate-limited per session

Session security

Sessions use cryptographically random tokens (128-bit entropy)
Sessions expire after 30 days of inactivity
Sessions are immediately invalidated on sign-out
Sessions are invalidated for all team members if an MSP subscription is cancelled

Audit logging

All significant actions are logged to an audit trail: authentication events, scan triggers, AI calls, and admin actions. Audit logs are retained for 12 months. No prompt content is stored in AI audit logs — only metadata (analysis type, token count, timestamp).

Data residency

Customer data is stored in Cloudflare's European Union jurisdiction: the database (including its recovery history), session data and backups. Cloudflare's network handles each request at the location nearest the visitor, which can be outside the EU, so data can pass through there in transit. Two things are not held in the EU: AI features send the data described in section 5 of the Privacy Policy to Anthropic in the United States, and the nightly backup passes through a temporary GitHub build server in the United States. Where Cloudflare processes data outside the UK and EEA, it does so under its data processing addendum (EU standard contractual clauses and the UK International Data Transfer Addendum).

Reporting a vulnerability

If you discover a security vulnerability in AZClarity, please email support@azclarity.com with details. We will acknowledge within 24 hours and aim to resolve critical issues within 48 hours. Please do not disclose publicly until we have had the opportunity to investigate and remediate.

Compliance

ICO registration: ZC142994 (Bennett AI Tech Ltd, company no. 17208567)
UK GDPR: Compliant — see Privacy Policy
Data processing: Lawful basis documented, DPA in place with sub-processors