Security
What runs where, who signs in where, and what the AI never does.
Where things sit
Conversation record in our Azure; inference in your Foundry project; sign-in in your Entra External ID tenant; files in the private Blob space we operate for you.
A real token, checked five ways
Registration is not a form that takes your word for it. The identity token the widget presents is verified against your Entra External ID tenant's published keys — signature, issuer, audience, the tenant id it was issued for, and the object id of the user — and only then does the session become an identified one. What we keep is the object id and the display fields your directory returns; passwords and other credentials never reach the service, because sign-in happens in your tenant.
Never trained on your data
No. Inference runs on the Azure AI Foundry project you already own, on a model you choose, under your own Azure agreement. Microsoft documents that Azure AI keeps prompts, completions and fine-tuned models within your own Azure AI Foundry resource and does not use them to train foundation models. We never run the model, so there is nothing for us to train on.
The AI never reads uploaded files
Where a registered user can upload a file, it lands in a private Azure Blob space, under quotas and per-agent permissions, for your team to review from the conversation. It is not read, indexed or summarised by the AI: people review it.
Where it runs
The service runs in the region we operate in; your Azure AI Foundry project and your Entra External ID tenant stay wherever you put them, because both are yours.
Sign-in and the application controls
Sign-in for your team is Teams SSO. Visitor identity, when you turn it on, lives in your own Microsoft Entra External ID tenant — including any social identity providers you configure there. Administrators do not manage external users inside the app: the directory is yours.
The application uses managed identity, RBAC, encryption in transit and at rest, and content-free telemetry. The Azure platform it runs on holds Microsoft's certifications.
The full reference, including data handling, is in the documentation: Security and compliance.