Security, by product
Where the record lives, who can reach it, how updates arrive, and what the AI never does — for Hosted, Self-Hosted and the Private plan.
Point of Contact — Self-Hosted
A managed application in an Azure subscription you deploy it into.
Your subscription is the boundary
The whole stack — Function App, Cosmos DB, SignalR, Key Vault, a storage account and the Azure AI Foundry resource — deploys into your own Azure subscription, and the conversation record never leaves your tenant. Standing, the publisher role is read-only on the managed resource group — it cannot deploy code, read a Key Vault secret or reach the conversation store. Anything more is a just-in-time elevation you approve, capped at 8 hours and written to your Activity Log; two Azure policies deny the publisher any direct path to Cosmos.
Publisher access: just-in-time only
Just-in-time only. Standing, the publisher role is read-only on the managed resource group — it cannot deploy code, read a Key Vault secret or reach the conversation store. Elevation is ManualApprove by one to five approvers you nominate at purchase, capped at 8 hours per request and recorded in your Activity Log; approving needs Microsoft Entra ID P2. Two Azure policies deny the publisher any direct path to Cosmos.
Updates you apply. Nothing is pushed.
We publish signed releases to a public feed and never push into your deployment. You initiate an update from your side; the runtime fetches the manifest, verifies the ES256 signature against a key pinned in three independent places, checks the version chain and the artifact's SHA-256, and only then applies it. You choose when; the version is pinned and inspectable before it runs.
Self-Hosted needs Entra ID P2
Yes — Self-Hosted requires Microsoft Entra ID P2. Just-in-time publisher access is mandatory, is configured once when the managed application is created and cannot be added later, and approving an elevation request needs a P2 licence for the approvers you nominate. If P2 is not an option, the Private plan needs none — and Hosted needs none either.
Two callbacks, both content-free
Two callbacks leave a Self-Hosted deployment, and you can read both in the source. The hourly seat report is a number — how many distinct human agents held a seat — with an aggregate token count for the cost dashboard. The deployment-status ping says which version deployed and whether it succeeded, and carries your tenant id and the purchasing admin's email so we can reach a human if it did not. There is no message content, no visitor names, no session or conversation ids in either. Both payloads are pinned by strict schemas at the boundary, and a build-pipeline gate fails the build if a forbidden field could reach a log line.
Permissions to install
Two permissions gate the install. On the target Azure subscription you need Owner, or Contributor plus User Access Administrator, because the template creates role assignments for the Function App's managed identity — Contributor alone fails at the first one. In your directory you need Microsoft Entra ID P2 for the one to five approvers you nominate, because approving a just-in-time elevation requires it. Line both up before you buy, not after.
Self-Hosted — Private plan
For reviews that will not accept even a consent gate.
Publisher access: none
None. The Private plan carries no publisher authorization at all: no standing role, no just-in-time path to request one, no metering. Nobody at the publisher can reach the deployment, including in an emergency; updates are the signed releases you choose to apply.
Private plan: no publisher role at all
For reviews that will not accept even a consent gate there is a private plan by arrangement: a negotiated flat fee, no publisher role on your deployment at all — no standing access and no just-in-time path to request one — no metering, and no Entra ID P2 requirement. Same managed application, same Teams tab, same widget; updates are the signed releases you choose to apply.
No Entra ID P2 on Private
The Private plan needs no Microsoft Entra ID P2. The licence exists on the public plan because someone has to approve a just-in-time elevation; the Private plan has no publisher role on your deployment at all, so there is nothing to approve and no approver to license.
Point of Contact — Hosted
A multi-tenant service we operate.
On Hosted: model processing is yours; conversation storage is ours. Your Foundry project handles every prompt and completion under your own Azure agreement — we never see them. The conversation record — transcripts, files, session state — is stored in our Azure, and our operations team can access it to support you. If your review requires that no vendor can reach that record, that is exactly what Self-Hosted and Private are for.
Publisher access: yes — we operate it
On Hosted, yes: we operate the service, and our operations team can reach the conversation record — transcripts, files, session state — to support you. Model processing is different: your Foundry project handles every prompt and completion under your own Azure agreement. If your review requires that no vendor can reach the record, that is what Self-Hosted and Private are for.
Where things sit on Hosted
Three places. The conversation record — transcripts, files, session state — lives in our Azure, operated by us. Every prompt and completion runs in the Azure AI Foundry project you own, billed to you by Microsoft. Visitor identity lives in your Entra External ID tenant; we validate the token and store the object id, never the credentials. The honesty block on the listing states this in full.
On every product
Never trained on your data
No — on every product. On Self-Hosted and Private, inference runs on the Azure AI Foundry resource and project the deployment provisions into your subscription — or a Foundry project you already own, connected instead. Microsoft documents that Azure AI keeps prompts, completions and fine-tuned models within your Azure tenant and does not use them to train foundation models. We never run the model, so there is nothing for us to train on.
The AI never reads uploaded files
Where a registered user can upload a file — on Hosted today, and coming to Self-Hosted — it lands in a private Azure Blob space, under quotas and per-agent permissions, for your team to review from the conversation. It is not read, indexed or summarised by the AI: people review it. That is true on every product.
Where it runs
Residency is a property of the product you choose. On Self-Hosted and Private you pick the Azure region at deploy time and the whole stack — including the conversation record — lands there. On Hosted the service runs in the region we operate in, while the Azure AI Foundry project and the Entra External ID tenant stay wherever you put them, because both are yours.
Sign-in, and what we do not claim
Sign-in for your team is Teams SSO. Visitor identity, when you turn it on, lives in your own Microsoft Entra External ID tenant — including any social identity providers you configure there. Administrators do not manage external users inside the app: the directory is yours.
A Self-Hosted deployment inherits the controls of the subscription it runs in, and the Azure platform holds Microsoft's certifications. The application uses managed identity, RBAC, encryption in transit and at rest, and content-free telemetry. On Hosted the same application controls apply, and the honesty block above states who can reach the record. We do not scan uploaded files, and we do not claim to.