Data Handling

Calibrant evaluates the configuration of your Microsoft 365 tenant — not its content. This page describes what scan data exists, where it lives, and when it is deleted.

What a scan collects

Scans read configuration state: security settings, policy definitions and their enabled/disabled state, DNS records for your mail domains, license and add-on availability, and counts or small samples of directory objects where a check requires them (for example, the number of admins without MFA-capable methods registered).

Security Baseline also freezes the Fabric/Power BI and Power Platform prerequisite choices that existed when the scan started. A manual-review or Not in use choice includes the explanation and evidence reference supplied by an owner or administrator. Those fields can contain internal operational context, so members can see the scan's overall evidence coverage but cannot see the selected choices, explanations, references, actor, or exact answer time.

Security Baseline can also pause an unpublished result for focused administrator context. This is used when Microsoft Graph omits the separate OneDrive sharing slider or a Fabric response omits the security-group scope needed for an honest verdict. The temporary request queue and its aggregate Microsoft evidence are service-private and are deleted when the question is answered or the scan becomes completed, failed, or cancelled. The answer is frozen into that audit, and a reusable current answer keeps only a SHA-256 evidence identity. A later scan reuses it only when the relevant evidence and Calibrant ruleset are unchanged.

Tenant Healthcheck follows the same evidence boundary for administrator context. Stable Tenant Context is frozen when a scan begins. If Microsoft configuration can prove only part of a control, the scan can temporarily retain the preliminary finding and ask an owner or administrator a focused follow-up about intent, complete scope, justified exclusions, policy quality, or an explicitly allowed outside safeguard. That temporary review queue is not readable through the customer database role, and Calibrant publishes neither findings nor a score while it remains open. After the answer is saved, the Microsoft evidence and administrator answer are resolved as one control verdict and frozen together.

For Conditional Access review, collection includes policy names, included and excluded users, groups, roles and applications, conditions, grant controls, and session controls so an administrator can review the actual policy scope. For Intune compliance, Calibrant returns policy and assignment counts plus platform types, not policy names or assigned group names. These details remain restricted audit evidence; ordinary workspace members see the resulting shared finding rather than the administrator's answer, note, evidence reference, or exact answer time.

What a scan never collects

• Email content, attachments, or message metadata
• Files in SharePoint or OneDrive
• Teams messages or meeting content
• User passwords or credentials of any kind

The relay's script catalogue contains only read operations against configuration surfaces — there is no code path that touches mailbox, file, or message content.

Where findings are stored

Scan results are stored in Calibrant's database (Postgres, hosted on Supabase) with row-level security enforcing tenant isolation on every table: your workspace's rows are readable only by authenticated members of your workspace. Secrets, such as relay credentials, are held in an encrypted vault, and all traffic is TLS in transit.

A completed scan is saved as one all-or-nothing audit result: its expected findings, score, summaries, license evidence, questionnaire evidence, and integrity identity must agree. Calibrant does not publish a partial database write as a trusted completed scan.

Retention — tiered by granularity

Retention is deliberately tiered so long-term trends survive without keeping detailed tenant data longer than needed:

• Scores and compact audit context (overall and per-category scores, scan scope/finality, capability yes/no values, and evidence digests): kept for the life of the account — they power trend charts and explain why a licensed-product check did or did not apply. The compact license snapshot does not retain product/SKU names.
• Security prerequisite and context records: integration-intent choices remain until an owner or administrator replaces them. A result-driven answer is reused for up to 90 days only while its relevant evidence identity and ruleset still match. The immutable copy captured or completed for a scan follows the same plan-based retention window as detailed findings (with the most recent scan preserved), while the compact complete/provisional/incomplete label remains on the scan. Deleting the scan deletes its frozen copy. Explanations and evidence references are never shown to ordinary members. A temporary unanswered request and its aggregate raw evidence are deleted when the scan becomes terminal.
• Healthcheck administrator context: stable Tenant Context is reusable for 90 days unless replaced. A scan-specific follow-up is reusable during that period only when a later scan returns the same relevant Microsoft evidence under the same Calibrant evaluation version. Changed evidence or related evaluation logic requires the affected answer to be reconfirmed; an older answer that predates this identity may be requested once under the new process. Calibrant stores a SHA-256 identity for that comparison, not another copy of the raw evidence. Each scan freezes its own answer so clearing or replacing the current answer cannot rewrite an older audit. Frozen notes, evidence references, actor, and answer time follow the detailed-finding retention window and remain owner/admin-only. A temporary unanswered follow-up is deleted as it is answered, or with the scan if that scan is cancelled or removed.
• Finding detail (per-rule results, messages, remediation): kept for your plan's history window — 14 days without an active subscription, 60 days on Essential, 2 years on Pro. The most recent scan's findings are always preserved.
• Raw evidence (collected configuration payloads and logs, including the source product/SKU-name inventory): capped at 90 days on every plan.

Calibrant currently supports only Microsoft's commercial cloud. Microsoft 365 GCC, GCC High, DoD, China/21Vianet, and every other sovereign or national cloud are not supported; their endpoints and license portfolios are not treated as valid commercial scan evidence.

A scheduled job prunes past-window data automatically. Deleting a scan or an assessment removes its findings immediately, and offboarding your tenant removes the workspace's data.

Backup and recovery limits

Calibrant currently relies on provider-managed daily database backups, not point-in-time recovery. In a serious database recovery event, changes made since the latest usable backup could be lost — up to 24 hours. Calibrant has an internal four-hour recovery objective, but it has not been proven by a full restore exercise and is not a customer service-level promise during early access.

AI analysis

Scan summaries and recommendations are generated with Anthropic's Claude models. Healthcheck and Security Baseline prompts contain bounded, non-identifying audit metadata: rule or control identifiers, titles, categories, severities, status counts, and scores. They do not contain collected configuration evidence, finding messages, attestation notes, administrator names, credentials, or tenant domains. Weekly Insights uses score history and category or framework labels only.

Consent before access

Data access is gated on explicit consent: connecting Microsoft 365 requires accepting the data-access authorization, and the first scan requires acknowledging the scan disclaimer. Both acceptances are recorded with the exact reviewed document digest, version, timestamp, and acting user.