Security & trust

How Assetto accesses your tenant

Assetto connects through a Microsoft Entra application registration in your own directory, using application-only (client credentials) access. A Global Administrator grants consent once, and can revoke it at any time from your own tenant without involving us.

• Read-only. The permissions Assetto requests are read scopes. It does not hold write access to your directory, devices or mailboxes.
• No agent. Nothing is installed on endpoints or servers. All reads go through the Microsoft Graph API.
• No delegated access. Assetto never acts on behalf of a signed-in user and never asks users for their credentials.
• Least privilege, and visible. The application permissions in use, and what each one unlocks, are listed inside the product.

What is stored, and what is not

Assetto stores configuration metadata — policy settings, role assignments, sharing configuration, device configuration profiles, alert summaries — so it can compare today against your recorded baseline.

• Mailbox contents, files, documents and chat messages are never read or stored.
• End-user passwords are never accessed, and Assetto has no ability to read them.
• Directory data is limited to what posture assessment requires.

Credential handling

The client secret for your app registration is encrypted at rest with AES-256-GCM. The encryption is bound to your organization's identity as additional authenticated data, which means a stored ciphertext copied to another organization's record will not decrypt — isolation is enforced by the cryptography, not only by a query filter.

Access tokens are held server-side only and are never sent to a browser. Assetto monitors the expiry of your stored credential and warns before it lapses, because a silently expired credential means silently absent monitoring.

Tenant isolation

Assetto is multi-tenant, and separation is structural rather than conventional. Every record belonging to a customer carries its organization identifier as a required field, enforced by the type system, and every request resolves its organization through a single authorisation chokepoint. The organization is derived from the signed-in identity's memberships — never from anything the browser sends.

Isolation is covered by an automated test suite that runs as a release gate, so a change that weakened separation would fail the build rather than ship.

Data residency

Assetto is built and operated in the European Union. Customer data is hosted in the EU and is not transferred outside it in the course of normal operation. We are an EU company and are subject to the GDPR as a processor for the configuration data we hold on your behalf.

What we do not yet have

We would rather tell you this than let you find out on a questionnaire. Assetto does not currently hold an ISO 27001 certification or a SOC 2 report. We are an early-stage product and have not completed a third-party audit. If a formal attestation is a hard requirement for your procurement process, tell us early and we will be straight with you about timelines.

We are happy to complete a security questionnaire, sign a DPA, and walk your team through the architecture in detail.