In transit
TLS 1.2 or newer for product and provider connections.
Security
Read-only by design, separated by workload.
The service cannot modify monitored Microsoft 365 configurations. It uses read permissions and creates monitoring subscriptions required by Microsoft.
Connector Permissions
Exact application permissions for each connector app.
Customers consent only to the workloads they enable. The Microsoft sign-in application uses delegated openid, profile, and email scopes separately from connector access.
| Connector App | Workload | Application Permissions |
|---|---|---|
| ChangeWitness Entra Connector | Microsoft Entra | AuditLog.Read.All |
| ChangeWitness Intune Connector | Microsoft Intune | DeviceManagementApps.Read.All |
| ChangeWitness Teams Connector | Microsoft Teams | Team.ReadBasic.All, Channel.ReadBasic.All, TeamMember.Read.All, ChannelMember.Read.All |
Connector Authentication
Certificate credentials, with production keys in Azure Key Vault.
Connector applications use certificate-based Microsoft client credentials. Production signing keys are designed to remain non-exportable in Azure Key Vault, accessed from Vercel through OIDC workload identity federation.
- Root of trust
- Azure Key Vault with non-exportable connector signing keys.
- Workload identity
- Vercel OIDC federation scoped by project and environment claims.
- Destination secrets
- Versioned envelope encryption, with wrapped data keys separated from the key-encryption key.
Data Protection
Encryption across storage, transport, and connector credentials.
At rest
Provider-managed encryption for operational data and private storage.
Tenant isolation
Row Level Security, strict SaaS RBAC, and no direct browser access to operational tables.
Hosting
Core application Functions and product data are placed in Frankfurt.
Named subprocessors may process limited data elsewhere, including Resend email metadata and logs in the United States, as disclosed in the trust center and DPA.
Put a witness on critical changes.
Start with a focused, source-backed view across the Microsoft 365 tenants you manage.