What data is stored and for how long

What we store

• Your workspace: organization name, team members (name, email and role from Microsoft sign-in), plan and billing status. Card details stay with Stripe; we never see them.
• Customers: tenant ID, domain, display name, module and consent status, schedules and run history.
• Assessment results: the configuration data collected in each run, the HTML report and the Word and PowerPoint files, in that customer's own isolated storage container.
• Branding: your logo and branding settings, stored privately.
• Feedback board: suggestions, votes and comments you post (shown to other customers without your name or company).
• Audit log: a record of changes in your organization (who added a customer, enabled a module, changed branding and so on).

What we don’t store

• Your password or your customers’ passwords.
• Email, files, chats, calendars or document contents.
• Client secrets or certificates for customer tenants (module apps use workload identity federation).
• Tenant contents in logs, URLs or query strings. Logs record run and organization IDs only.

How long we keep it

• Assessment results and reports are kept until you delete them: delete a single assessment (how) or offboard a customer to delete all of its data (how).
• Workspace information is kept while your workspace exists. When a subscription ends, reports stay available until you delete them or ask us to close the workspace.
• See our privacy policy for the formal retention terms.

Where it lives

M365Assessments runs on Microsoft Azure, and data is stored in Azure data centers in the United States. Regional hosting outside the US isn’t offered yet.