The answers a buyer needs before paying

simiriki is an operational-infrastructure platform for Microsoft 365 security, focused on Mexican mid-market companies. It evaluates insecure configuration with 201 detection rules and maintains a catalog of 188 playbooks that support remediation routes. It executes an approved change only when the exact rule-to-playbook binding is certified; guided and advisory routes remain clearly labeled as such. It reads Defender, Sentinel, Purview and Power Platform configuration where the consented APIs allow, with regulatory mapping to LFPDPPP / CNBV / NOM-151. It does not resell or implement Sentinel or Defender XDR as a managed SIEM/MSSP.

The free scan connects your Microsoft 365 tenant via read-only OAuth, runs the 155 Microsoft Graph rules of the 201-rule library and calculates an sIPO score (0–100) with grade A+ to F; the on-screen preview usually appears within a couple of minutes (larger tenants can take longer because Microsoft Graph is rate-limited) and the 3-page PDF Posture Brief is delivered in under an hour. No credit card required. The OAuth consent is strictly read-only — no rule writes to your tenant. The 46 Azure Resource Manager rules are added when you connect with admin consent and Reader role (Operación).

Only security configuration, never content. Via Microsoft Graph + Azure Resource Manager (read-only consent) we read: identity and conditional-access policies, MFA state and methods, privileged roles and assignments, application (OAuth) consents, Exchange/mail configuration (DKIM/DMARC/forwarding rules — not the mail itself), Purview DLP policies and labels, device/Intune configuration, SharePoint/OneDrive external sharing, and Azure resource configuration (NSGs, storage, encryption, Defender for Cloud). We never read the body of emails, files, chats, or calendars. You can revoke access anytime from your Microsoft 365 portal.

Production runs on one Hetzner VPS in Ashburn, Virginia, published through Cloudflare Tunnel. PostgreSQL and Redis bind to loopback only. Sensitive tokens use application-layer AES-256-GCM; verified PostgreSQL backups are created hourly and the encrypted offsite channel is explicitly monitored. There is no multi-region failover. Portable data is provided in standard formats where applicable.

Not for the Escaneo or free Auditoría. Available checks and remediation paths depend on the licenses and APIs present in your tenant; for example, Conditional Access requires Microsoft Entra ID P1. Operación does not require or resell E5, Defender XDR, or Microsoft Sentinel. Controls that your licensing cannot verify are shown as pending or skipped rather than treated as passed.

There are 188 rather than 201 because several rules share one remediation route. The catalog is mapped by capability and every change requires approval. Today, 21 playbooks have a real automatic Microsoft Graph executor; the remainder are guided, assisted, or report-only according to API capability and risk. A remediation route is not the same as automatic execution, and pending or unverified controls are shown as such.

Yes. For each MXN payment we issue your CFDI 4.0 (XML + PDF to the buyer's email and the receiving RFC). We collect your RFC, tax regime, and uso CFDI at intake. Supported voucher types: Ingreso, Egreso, Traslado, Pago; default uso CFDI G03 (general expenses), adjustable at intake. Automatic emission via our PAC with the SAT is being enabled; in the meantime we coordinate each invoice with you directly.

Yes. The Operación prices listed on /precios and /operacion are in Mexican pesos with the 16% IVA included (the Auditoría is free). The 16% rate (Ley del IVA, Art. 1, Mexico) is already included in the displayed price. Every CFDI we issue itemizes the subtotal + IVA on the transferred-tax line.

It depends where you are. If you access from outside Mexico (on /en) prices display and are charged in USD, and you receive a Stripe receipt for each payment. Inside Mexico prices are in MXN with 16% IVA included, and we issue CFDI 4.0 on request (the IVA is itemized on the CFDI; automatic emission via PAC before the SAT is being enabled). IVA is a Mexican tax: it does not apply to customers billed in USD.

Studio offers are paid under the written quote. Operation uses Stripe Checkout after a completed buyer-bound Audit; its canonical first payment is USD $3,900. General checkout is closed. Only an authorized pilot bound to the buyer and a completed Audit can initiate purchase through the outcomes API; all other customers start with the free Audit.

No. The Auditoría is free: you connect Microsoft 365 read-only, we run the 155 Microsoft Graph rules of the 201-rule library and deliver the full report — posture score, observed findings, pending controls, prioritized remediation plan, and bilingual PDF — at no cost and with no card. There is nothing to refund because there is no payment.

Yes. The guarantee covers the first payment, including setup, for 14 days and only while no subscription remediation has reached applied or verified. Monthly cancellation is separate. General checkout is closed. Only an authorized pilot bound to the buyer and a completed Audit can initiate purchase through the outcomes API; all other customers start with the free Audit.

Yes. Cancellation is scheduled for period end from the billing portal or, for an agent buyer, with POST to the cancellation endpoint authenticated by the purchase token. DELETE withdraws a scheduled cancellation before it becomes effective.

The free Audit creates no contract. Operation is monthly and cancellation is scheduled for period end. General checkout is closed. Only an authorized pilot bound to the buyer and a completed Audit can initiate purchase through the outcomes API; all other customers start with the free Audit.

Each rule maps to one or more primary sources: CIS Microsoft 365 Foundations Benchmark v3.0 (L1 + L2), CISA Cross-Sector Cybersecurity Performance Goals, CISA SCuBA / ScubaGear (baselines applied to US federal agencies), NIST CSF 2.0, NIST 800-53, Microsoft Cloud Security Benchmark. For the Mexican context: LFPDPPP Art. 18 (security measures), CNBV Circular Única Art. 168 Bis 11 (3-year log retention, 10-year immutable incident archive), NOM-151 where applicable. The rule-by-rule SCuBA mapping is published in docs/SCUBAGEAR_MAPPING.md.

Yes. simiriki S.A. de C.V. operates under the Federal Personal Data Protection Act. We publish a privacy notice at /privacidad, a DPA available at /dpa, retain personal data per customer policy, and provide ARCO rights (Access, Rectification, Cancellation, Opposition) — requests to hola@simiriki.com answered within 20 business days.

Yes. Microsoft Partner One ID 6972092. The methodology and 9 active connectors are built on Microsoft Graph + Azure Resource Manager APIs, with licensing and implementation aligned to Partner program agreements.

Requests are recorded at /cotizar and receive an email confirmation. Scope, delivery date, support, and any committed response time appear in the accepted quote or agreement; public availability is visible at status.simiriki.com.

No. simiriki operates by email and portal. Operational history (what changed, when, by whom, and with what authorisation) requires a persistent audit trail. If a live conversation is needed for an accepted scope, it is coordinated by email.