Security Overview
Cloud Locksmith is built around four principles: least privilege access, deterministic remediation, transparency about what is accessed, and full auditability of every action taken. The platform reads Microsoft 365 identity data in read-only mode by default; any change to your tenant configuration requires an explicit admin approval before it is executed, and every approved action is logged.
Microsoft Integration
- • OAuth 2.0 authentication via Microsoft Entra ID — Cloud Locksmith never collects or stores your Microsoft password.
- • All tenant data is read through the Microsoft Graph API using delegated permissions scoped to the signed-in admin's consent.
- • Microsoft-verified application: verification is in progress. This page will be updated once Microsoft completes its review.
- • No password collection: authentication is handled entirely by Microsoft; Cloud Locksmith only receives a signed OAuth token.
Data Handling
What we access
User accounts and profiles, directory roles, registered authentication methods, Conditional Access policy configuration, license assignments, and sign-in logs.
What we never access
Email bodies and headers, document contents (SharePoint or OneDrive), Teams messages, and calendar content.
Tenant isolation
Each tenant's data and OAuth tokens are stored and queried independently; no query spans more than one tenant.
OAuth token encryption
Access and refresh tokens are encrypted at rest and are never exposed to the frontend.
Data deletion process
Disconnecting a tenant revokes its tokens immediately. Retained data is deleted within 30 days, with backups purged within 60 days.
Customer ownership of data
Your tenant data belongs to you. We do not sell it, use it for advertising, or share it beyond the infrastructure providers required to operate the service.
Infrastructure Security
- • Encryption in transit: all traffic between your browser, Cloud Locksmith, and Microsoft Graph is encrypted using TLS.
- • Encryption at rest: stored tenant data and credentials are encrypted at rest.
- • Application-layer encryption for OAuth tokens: access and refresh tokens receive an additional layer of encryption beyond disk-level encryption, and are never returned to the browser.
- • Audit logging: remediation actions, break-glass account usage, and administrative access are logged.
- • Secure secret management: application secrets and encryption keys are managed through the hosting provider's secret management tooling rather than stored in source control.
We do not currently hold SOC 2, ISO 27001, or other third-party security certifications. See the Compliance Roadmap below.
Security Principles
Least Privilege
Cloud Locksmith requests only the Microsoft Graph permissions required to assess identity posture, and nothing more. If a scope isn't documented on this page, we don't have it.
Transparency
Every permission we request, every data type we access, and every action we take is documented and visible to you before you connect a tenant.
Deterministic Remediation
Fixes are explicit, reviewable, and reversible. Nothing changes in your tenant without an admin approving the specific action first.
Customer Control
You decide what gets fixed and when. You can disconnect at any time, and your data is deleted on a defined schedule when you do.
Privacy
- • We do not sell customer data.
- • We do not use customer data for advertising.
- • You control data deletion — disconnecting your tenant triggers deletion per our retention policy.
Responsible Disclosure
If you believe you've found a security vulnerability in Cloud Locksmith, please report it to security.cloudlocksmith@gmail.com. Include enough detail to reproduce the issue. We investigate all reports and will acknowledge receipt as soon as possible.
Roadmap — Not Current Certifications
Cloud Locksmith does not currently hold formal security certifications. As the platform matures, we are working toward the following goals. None of the items below have been achieved as of this writing.
- Microsoft Marketplace / AppSource verification
- SOC 2
- ISO 27001
- Additional compliance certifications as customer needs require