AzureScanRead-only access
Your administrator gives the AzureScan app three built-in Azure roles, and nothing more:
- Reader: read the description of your resources
- Cost Management Reader: read your costs
- Reservations Reader (optional): read your reservations
With these roles AzureScan cannot change, create or delete anything. You carry out recommendations yourself, or your IT partner does.
What we read, and what never
- We read: names, sizes, region, tags and state of resources, your costs, and performance figures such as CPU and memory use.
- We never read: files, databases, mailboxes, disk contents, passwords or keys.
Your data stays in Belgium
The portal and the database run in Microsoft Azure in Belgium (region Belgium Central). Backups stay in the same region; no copies go to other countries. The forms on this website are processed by our own application, without an external form service.
A locked-down, containerised platform
AzureScan does not run on servers we maintain ourselves. The portal and the nightly scanner are containers on Azure Container Apps, a platform that Microsoft manages and patches.
- Each part runs in its own container, on a minimal Linux image, as an ordinary user without administrator (root) rights.
- The portal is reachable over HTTPS only. The platform checks the Microsoft sign-in before a request ever reaches our application.
- Our container images are kept in our own private container registry, without an admin account. The containers fetch them with a managed identity.
- The whole environment is described in code (infrastructure as code), so test and production are set up identically and every change is recorded.
- Production runs exactly the container that passed the tests in the test environment: it is promoted, never rebuilt, and only after approval.
Who sees your data
- Your own organisation, signed in with your own Microsoft work accounts. Multi-factor authentication (MFA) follows your organisation's policy.
- Your MSP, if you work through one: only the people the MSP puts on its own team, and only for its own customers.
- AzureScan, to guide you.
- Every organisation sees only its own data. Automated tests check this with every new version.
How long we keep anything
- While you are a customer: your scans, findings and the log of what happened in the portal.
- When the agreement ends: findings, reports and log deleted at once; the first scan (evidence for the savings guarantee) 30 days later, and not before the guarantee period has passed.
- Database backups: 7 days. Technical logs: 30 days.
Revoke access in one step
Delete the AzureScan app in Microsoft Entra ID, or remove its roles, and AzureScan can no longer read anything, straight away. You don't need us for that.
GDPR: the roles in the chain
- You are the controller of the data in your Azure environment.
- If you work through an MSP, your MSP is the processor and AzureScan a sub-processor; otherwise AzureScan is your processor.
- Our only sub-processor is Microsoft (Azure and Microsoft 365), within the EU.
- Data processing agreement: on request, also in a version an MSP can pass on to its own customers.
How we secure it
- Sign-in through Microsoft Entra ID: we store no passwords.
- All connections encrypted (TLS), including to the database. Data encrypted at rest.
- Secrets in Azure Key Vault, and managed identities instead of passwords between our components.
- A log of who approved or changed what in the portal.
What we are still improving
We are open about what can be better. We are currently working on a private network connection between the portal and the database, which is now protected by a password and encryption.
If something goes wrong
If we discover a security incident that affects your data, we inform you (and your MSP) without undue delay and at the latest within 48 hours, with what we know and what we are doing. That way you can meet the legal 72-hour deadline.
Documents and questions
Would you like the data processing agreement or our security and GDPR document for your own assessment? Ask at bart@bpollet.eu. More detail is in our privacy statement.