Built to ask for as little as possible — and to be easy to walk away from.

What CybrOak accesses — and what it never touches

You connect CybrOak by signing in with Microsoft Entra ID and granting admin consent. From sign-in we receive your name, email address, Azure tenant ID and user object ID, used only to authenticate you and scope your data to your organization. By default the consent covers exactly one Graph permission beyond those standard sign-in claims:

With it we read device name, OS and version, compliance state, BitLocker / Defender / firewall status, last sync time, enrolled user, manufacturer, model and serial number. We never read file contents, browsing history, location data or any user-generated content from end-user devices. No agent, ever — nothing is installed on a single endpoint.

Read-only by default — remediation is your choice

The default consent is read-only: CybrOak can see your posture but cannot change a device, policy or group. Remediation features that write to Intune need the additional scopes below. They are off by default, each one requires a separate admin re-consent in Microsoft (so the consent screen always shows exactly what was added), and every remediation action is written to your audit log with per-device progress. Without these scopes granted, nothing is ever written to your tenant.

Policy enforcement deliberately stops short of assignment: CybrOak creates the Intune configuration policy unassigned, and an administrator reviews and assigns it in Intune.

Token handling

• Microsoft refresh tokens are encrypted at rest with a key held only by the API service (Fernet / AES-128-CBC with HMAC) before they are written to the database.
• Access tokens for Graph are short-lived, requested on demand for a sync, and never persisted.
• Your CybrOak session is a signed JWT that expires after 8 hours. It is the single first-party entry we keep in your browser (cybroak_token) and is sent to api.cybroak.com over TLS.
• The plan you choose on sign-up travels inside a signed, 60-minute OAuth state, so nothing about your account is trusted from the browser after Microsoft redirects back.

Encryption in transit and at rest

• All traffic between your browser, cybroak.com and api.cybroak.com uses TLS 1.2 or higher with HSTS enabled.
• Calls from CybrOak to Microsoft Graph use TLS 1.2 or higher.
• Customer data lives in an encrypted PostgreSQL database hosted on Railway in the US-East region. Data is not stored in any other region.
• Secrets (client secrets, encryption key, API keys) are injected as environment variables and never committed to source.

Tenant isolation

Every record — devices, findings, snapshots, remediation actions, audit entries, evidence packs — carries the owning tenant's ID, and every query is scoped by it. The API resolves your tenant from your signed session, never from a parameter you supply. Two customers can never see each other's data. MSP multi-tenant access only exists where a client tenant's own Global Administrator completed Microsoft consent through an invite link.

Evidence you can verify

Every evidence pack is registered the moment it is generated, with a unique Evidence ID and a SHA-256 fingerprint of the file. An auditor — or your client — can confirm a pack is genuine and unaltered at cybroak.com/verify/<id> with no login and no account. See a verified example.

Backups and data retention

• Backups run daily and are retained for 30 days.
• Device inventory and findings are kept while your workspace is active and refreshed on each sync.
• Daily posture snapshots power drift history (90 days on Starter, unlimited on Growth and above).
• We retain your data for the duration of your subscription. After cancellation it is retained for 30 days to allow reactivation, then permanently deleted. You can request immediate deletion at any time by emailing privacy@cybroak.com.

Your rights under GDPR / CCPA / UK DPA are described in our Privacy Policy.

Subprocessors

The following third parties process data on our behalf:

• Vercel — Frontend hosting and CDN
• Railway — Backend application and PostgreSQL database (US-East)
• Microsoft Graph API — The source of your device data
• Resend — Transactional email delivery (when enabled)
• Stripe — Payment processing (when applicable)
• Sentry — Application error tracking — no customer data; DOM content is masked in error replays

What we don't do

• We do not sell your data.
• We do not use third-party advertising trackers. Product analytics are minimal (page views, feature usage) and exist only to improve the service.
• We keep a single first-party cookie / localStorage entry (cybroak_token) to keep you signed in. No third-party tracking or advertising cookies.
• We do not claim a SOC 2 or ISO 27001 certification for CybrOak itself. CybrOak maps yourfleet to those frameworks; that is a different thing, and we won't blur it.

How to revoke CybrOak's access in Microsoft Entra

You stay in control. Revoking consent takes effect immediately — CybrOak loses all access to your tenant and the next sync fails closed.

1. Open the Microsoft Entra admin center → Identity → Applications → Enterprise applications.
2. Search for CybrOak and open it.
3. To remove permissions only: go to Permissions → Review permissions → Revoke, or delete the granted admin consent.
4. To remove the app entirely: go to Properties → Delete.
5. Optionally email privacy@cybroak.com to have your stored data deleted immediately rather than after the 30-day window.

Users can also remove the app from their own account at myapps.microsoft.com.

Reporting a vulnerability

If you believe you have found a security issue in CybrOak, email security@cybroak.comwith enough detail to reproduce it. A person reads every report; we will acknowledge it, keep you informed while we investigate, and credit researchers who want it. Please give us a reasonable window to fix the issue before publishing, and do not access data that isn't yours while testing.

Privacy and data requests go to privacy@cybroak.com. Service availability is published on the status page.