Skip to content
Trust & Security

Built for enterprise AI — with governance, auditability, and least privilege.

ScaleIQ is designed to satisfy CISO, audit, and procurement requirements before your team even gets to a procurement call.

Tenant-scoped Least-privilege Audit-grade evidence No training on your data

Tenant isolation

Logical tenant isolation by design — scoped at the application and database layers, with no shared inference. This is our design intent, not an independently validated result.

Least privilege

Scoped Graph permissions, just-enough access, and admin-approved consent for every connector.

Audit visibility

Evidence-grade logs of every action, recommendation, and policy decision — exportable on demand.

Secure-by-default

Encrypted in transit and at rest. SSO via Entra. MFA enforced. Conditional access supported.

Data handling

What we access. What we store. Where it runs.

What we access

  • Microsoft Graph signals (least privilege)
  • Entra & Azure configuration (read-only)
  • Copilot Studio agent metadata

What we store

  • Aggregated signals & derived insights
  • Audit & evidence trails
  • No content training. No model fine-tune on your data.

Where it runs

  • Microsoft Azure, East US 2 region — processing in the United States
  • AI inference via Azure OpenAI and Anthropic Claude, each named on our Subprocessors page — never used to train models
  • Sub-processors disclosed and reviewed

Retention & deletion

  • Active assessment data: kept 24 months from report delivery, deletable on request
  • WORM evidence (submitted documents, authorized-URL snapshots, signed assessment records): kept 7 years in immutable storage and cannot be deleted early
  • Documented data lifecycle
Governance capabilities

Controls that hold up under scrutiny.

Agent governance

Approve, monitor, and retire Copilot agents with policy-aware workflows and full evidence.

Connector controls

Allowlist, denylist, and constrain connectors per persona, environment, and risk class.

Approvals & evidence

Every change is logged with approver, justification, and policy basis — ready for audit.

Compliance posture

Security questionnaires, policy summaries, and our technical and organizational measures are available on request.

Documentation

Read the policies themselves.

Security Overview Privacy Notice Data Processing Addendum Subprocessors Retention & Deletion AI Use & Responsible AI Data Subject Requests Service Level Agreement Terms of Service

Need the security pack?

Architecture overview, data-flow diagrams, sub-processor list, and policy summary — sent on request.

Request Security Pack Read Security Overview

Readiness scores, findings, and recommendations are advisory indicators — not guarantees of compliance, security, or audit outcomes.