Security and trust

Read-only, by design

You connect a Microsoft 365 tenant by approving one Microsoft Entra application, "PB Tech Licence Intelligence Connector (read-only)". A Global Administrator or Privileged Role Administrator of your tenant approves it once. It is granted four application permissions, all of them read-only, and nothing else. It is not given an administrator role, and it has no permission to create, change or delete anything in your tenant.

The four permissions, and what each is used for

• Organization.Read.All: your organisation's name, tenant identifier and verified domains, so we can show which tenant is which and match it to your account.
• User.Read.All: the list of users who hold a licence, with their name, sign-in name, department, whether the account is enabled and which licences are assigned. People with no licence are discarded before anything is stored.
• AuditLog.Read.All: each licensed user's last sign-in dates, which is how we tell that a licence has not been used for 90 days. (This needs Microsoft Entra ID P1 or higher in your tenant. Without it we use the activity reports below.)
• Reports.Read.All: Microsoft's usage reports, to see the last activity date and whether the Microsoft 365 desktop apps are used, so we can suggest a cheaper licence where one would do.

What we store, and what we do not

We store: the names, sign-in names (user principal names) and departments of your licensed users, the licences assigned to them, the number of licences you hold of each kind, subscription renewal dates, and last sign-in and activity dates. We also store what you give us: your organisation's name, your team members' names and work email addresses, prices you enter, and the audit log of what people did in the product.

We never read or store: email, calendars, files, chats, documents, passwords, authentication tokens or any content of your tenant. The connector cannot reach them: it holds none of the permissions that would.

Where your data lives

• The application and its database run in Microsoft Azure in New Zealand North. The database is encrypted at rest with a key controlled by PB Tech, and all traffic uses TLS 1.2 or higher.
• Email we send you (invitations, notifications, statements) goes through Azure Communication Services, which processes it in Australia.
• The Ask feature answers questions about your licence data using PB Tech's own language model, running on PB Tech hardware. Your question and the figures it needs are sent to that model and are not sent to a third-party AI provider.

Signing in and access control

• Sign-in is with a Microsoft work or school account. Personal Microsoft accounts and guest accounts are refused, and we never see your password.
• Each organisation can require multi-factor sign-in. It is on by default, and only an owner can switch it off, which is recorded.
• People in your organisation have one of four roles (owner, admin, billing, viewer) that limit what they can do. Your data is separated from every other organisation's inside the database itself, not only in the application.
• On the free plan the names and per-person detail are withheld by the database, not just hidden on the page.
• Every sensitive action is written to an audit log your owners and admins can read.

PB Tech staff access

PB Tech staff cannot see your licensed users or your costs by default. If you want help, an owner or admin can grant support access for 24 hours, 72 hours or 7 days, and can end it early. While it is on, staff can only view, not change anything or export, every page view is recorded in your audit log, and your owners are emailed when access is granted, first used and ended.

Keeping and deleting data

• Disconnect a tenant and we delete everything we read from it 30 days later. You are emailed 7 days before.
• Close your organisation and we delete its data 30 days later, until when you can reopen it. Invoices and billing details are kept for 7 years for tax records.
• Conversations in Ask are deleted after 30 days.
• Free organisations that nobody has signed in to for 365 days get a 30 day notice and are then closed the same way.
• Owners can download all their organisation's data at any time.

How to revoke access

In Microsoft Entra admin centre, open Enterprise applications, find "PB Tech Licence Intelligence Connector (read-only)" and delete it. Access ends at once and our next read fails. You do not need to contact us.

Sub-processors

• Microsoft Azure: hosting, database, key management and, through Azure Communication Services, email delivery.
• Stripe: card payments, only if and when we turn card payments on. Today we invoice, and Stripe receives nothing.

The data processing agreement on the DPA page lists these formally. We will tell you before we add another.

Reporting a vulnerability

Email licensing@pbtech.co.nz. Our security.txt has the details. Please give us reasonable time to fix a problem before you publish it.