Security
What we touch, and what we never do.
A security product should be clear about its own access. Here is exactly what NetMinder can see in a client's Microsoft 365, what we store and where.
- Read-only access to the staff list
- The Microsoft 365 connection uses one application permission, User.Read.All, granted by the client's admin. We read names, email addresses and whether each account is active. We never read mailboxes, files, calendars or chats.
- What we store
- Each employee's name and work email, the practice emails they were sent, link visits, lessons, quiz answers and certificates. That's what the reports need, and nothing more.
- Where it lives
- The app runs on Cloudflare's network and data is stored in Cloudflare's database service. Traffic is encrypted in transit over HTTPS.
- Who can see what
- Each MSP sees only its own clients. Sign-in is rate limited, and actions like connecting a tenant or inviting a user are recorded in an audit log.
- Disconnecting
- An MSP can disconnect a client's Microsoft 365 at any time to stop syncing. The client can fully revoke access by removing the app under Enterprise applications in their own Entra admin portal.
- Practice emails stay safe
- Practice emails never carry attachments or software, and their links lead only to a lesson page. They're delivered using Microsoft 365's own setting for phishing simulations, so real filtering stays on.
Security questions
Do you hold a SOC 2 or ISO 27001 certification?
Not yet. We'd rather tell you that plainly than imply otherwise. This page describes exactly what the product does with data today, and we're happy to answer security questionnaires.
Can you read our clients' email?
No. The only Microsoft permission we ask for is read access to the user list. We never request mailbox access.
What happens to data when a client leaves?
Disconnect the client and syncing stops immediately. Ask us and we'll delete that client's records.
How do I report a security issue?
Use the contact form on the demo page and mark it as a security issue. We'll respond quickly and keep you updated.
Become a founding partner.
We're onboarding our first MSP partners now. Bring two clients and we'll set them up with you.