Privacy & data handling

What the review reads, what it never touches, and where your data goes

Written for the person who has to sign off on this before your admin runs anything: your IT lead, your procurement team, or you. Plain answers, not a wall of legal text.

Asking for your free review, and writing to us

During early access there is nothing to sign up for: the run page needs no code and no email address, and the review sends nothing to us.

The message boxes on our pages, and the optional box on the run page for news of updates, send what you type into them (your email address, your company name if you give it, and your message) to Web3Forms, a form service run by Web3Creative in India, which emails it to us. Web3Forms keeps its copy for 7 days, the shortest time it offers, and then deletes it. To filter out spam it may pass your internet address and your email address to two spam-checking services, CleanTalk and Akismet. Our pages contact Web3Forms only when you press Send.

If you would rather none of that happened, email ddbloom2@gmail.com instead. Either way, we use what you send only to reply to you or, if you asked to be kept posted, to tell you about new versions and the clean-up tool. It stays in our own mailbox, and in a list of who wrote to us in a spreadsheet in our own Google account, until we delete it; one reply saying stop ends the emails. No marketing, and nothing shared.

What the review reads

The review runs as a PowerShell script on your own administrator's computer, signed in with your own Microsoft 365 account. Before running it, your admin can print the full list of what it reads, without signing in to anything:

.\Invoke-M365Review.ps1 -ShowPermissions

Least privilege: the account needs Global Reader, Reports Reader and Security Reader. It does not need Global Administrator, except possibly once, to approve the read-only permissions.

It asks Microsoft for five read-only permissions — Directory.Read.All, Reports.Read.All, AuditLog.Read.All, SecurityEvents.Read.All and Policy.Read.All — and reads:

  • your company name, which subscriptions you pay for, which are free trials, and the date Microsoft holds for each one to renew or end
  • account names, sign-in names, department, whether each account is enabled or blocked, which licences it holds and when each was given out, and the date it last signed in
  • which accounts hold administrator roles, and which are registered for MFA
  • Microsoft's own usage reports: the date each person last used each app
  • the size of each mailbox, as a number only — never anything inside it — so no licence is proposed for removal from a mailbox too big to keep without one
  • whether each person has used Office on a Windows or Mac desktop, in a browser or on a phone (yes or no only, not what they opened or wrote)
  • three tenant settings: app consent, guest invitations, app registration
  • which outside apps have been given access to company mail, files, chats or settings, which of them Microsoft has verified, and the names of the permissions they hold — never anything the apps themselves can see
  • your Microsoft Secure Score and its suggested improvements

What it never touches

  • No email, files, chats, calendars or documents. No permission to read them is ever requested, so Microsoft would refuse the request.
  • No passwords. Sign-in is Microsoft's own prompt. We never see credentials.
  • No changes. Every request the review makes is a read. There is not a single write, update or delete request anywhere in Invoke-M365Review.ps1, and your admin can search it to confirm.

Step 2, the clean-up, is in your own admin's hands. Nothing we offer asks for permission to change anything: any change you decide on is made by your admin, by hand, in the Microsoft 365 admin center. A clean-up tool is coming soon. Before it is offered, this page will say exactly which permissions it asks for and what it can change.

Where the data goes

Nowhere. The review writes the full results to a folder on the computer that ran it, and that folder is yours. No server, no account, no database, no upload. Nothing reaches us unless you choose to send it, and you decide what to send — usually just the one-page report.

Its one request outside Microsoft comes before it signs in: it asks our website for the latest version number, so it can warn your admin if their copy is out of date. That request carries nothing about you or your Microsoft 365, and -SkipVersionCheck turns it off.

Every run also writes review-log.txt beside the report: which version ran, each step and how long it took, what could and could not be checked, and why a run stopped if it did. It holds no names, no email addresses and no codes, and it stays on that computer unless you send it to us to look into a problem.

If the report is also saved as a PDF, the Microsoft Edge browser already on that computer prints it from the file on disk. The report itself blocks every outside request, so printing it sends nothing either.

What we do with what you send us

  • We use it only to reply to you, look into a problem, or talk you through your report.
  • We store it on an encrypted, password-protected computer.
  • We delete it within 30 days of your report, or sooner on request.
  • We do not share it with anyone. No analytics and no AI service is involved in producing your report, ever.
  • We never use your data to train anything, or to sell to anyone.
  • Because the review runs on your own admin's computer and sends none of your data to us, we are not processing your personal data during the review itself.
  • For the files you choose to send us afterwards, we act as a data processor and you remain the controller.
  • If you need a signed Data Processing Agreement (GDPR Article 28, or the UK equivalent) before sharing files, say so and we will sign yours.
  • We are based in India. The review sends none of your data to us, so nothing leaves your country unless you choose to send it.

Checking you got the file we sent

Compare the fingerprint of the script against the one on our website:

Get-FileHash .\Invoke-M365Review.ps1 -Algorithm SHA256

See the current fingerprint on the home page. If the two do not match, do not run it.

Who we are

We are an independent IT consultancy. We are not affiliated with Microsoft, and we are not resellers, so we have nothing to gain from you buying more licences. TenantTrim is independent of Microsoft and not endorsed by it. Microsoft 365 and Copilot are trademarks of the Microsoft group of companies.

Questions about this page, or a request to delete data we hold? ddbloom2@gmail.com