Security

How Seat Census handles your tenant's data

You're giving a service a look inside your Microsoft 365 tenant. Here is exactly what it can do there, what it keeps, how that's protected, and when it's gone. The full detail is in the privacy policy.

1Access only as you, only while you use it

Only a person with an active Global Administrator role can sign in, checked at every sign-in.
Seat Census uses delegated permissions: it acts as you, with your rights. You approve them on Microsoft's consent screen, and you can remove Seat Census from your tenant at any time in the Entra admin center.
The audits and tools only read. The permission to change anything isn't part of sign-in; it's asked for the first time you run an action.

2Changes only when you confirm them

The only changes Seat Census makes are to enterprise apps: disable, enable or delete.
Each runs only after you confirm it in the app, and only if your latest lookup offered that exact change.
The Microsoft services your tenant runs on, and Seat Census itself, are never touched.

3Sign-ins that last a session

Your Microsoft sign-in tokens are kept only for your session: 2 hours without use, or 12 hours at most. Signing out deletes them at once.
They're encrypted while kept, and handed to the audit scripts privately, never on a command line or in a log.
The session cookie can't be read by scripts, is sent only over HTTPS, and the app refuses requests from other sites.

4Encrypted with your own key

Every tenant has its own encryption key. Everything Seat Census keeps from your tenant (audit results, reports, logs, held tool results and sign-in tokens) is encrypted with it, using AES-256-GCM.
The keys are kept in a separate key store, themselves encrypted by a master key.

5Tenants kept apart

The database enforces the separation itself, with row-level security: a request working for one tenant can't read another's rows.
Each audit and lookup runs in its own empty folder, deleted when it ends.
Reports open on a separate site, reports.seatcensus.com, through links that work once and expire within minutes, in a sandbox that blocks all network access.
PDFs are drawn by a browser in a container of its own, with no network, no secrets and its sandbox on.

6Gone when you leave

Closing your account deletes all of your tenant's data, your tenant's key and your sessions immediately, and cancels any subscription.
Backups of your data are encrypted with your key, so once it's deleted they can't be read. Key-store backups are deleted within 7 days, so seven days after you leave, no copy of your data can be decrypted.
Free accounts unused for 90 days are deleted the same way.

7What we can see

Our administration panel shows account details only: your tenant's name and domain, the admins who've signed in, your plan and run counts. It has no access to your audit data or your keys.
Our logs record IDs only, never names, addresses or results.

8No tracking

No analytics, no advertising, no third-party scripts, on this site or in the app.
Two cookies in the app, both for sign-in, and none on this site.
Seat Census sends no email.

Report a problem

Found a security issue?

Please tell us at security@seatcensus.com before telling anyone else, with enough detail to reproduce it. We'll reply, keep you posted while we fix it, and credit you if you'd like.

Technical preview

Seat Census is new, and during the preview it runs on servers we operate. Until Microsoft verifies Seat Census as a publisher, Microsoft's consent screen shows it as unverified.