SIMIRIKIMICROSOFT 365 · READ-ONLY PILOT
How this assessment handles your data.
This notice describes the current Simiriki read-only assessment pilot. Review it before connecting your organization. A full assessment or remediation engagement requires a separately agreed scope.
What the scan reads
Available Microsoft 365 configuration and directory metadata, including organization identifiers, account names or email addresses, application permissions and security policies. The assessment also reads public email-authentication DNS records for Microsoft-verified domains, using the computer’s configured DNS resolver. Findings can include identifiable account or resource details. Coverage depends on the permissions, roles and sources available to the signed-in user.
What the scan does
Simiriki reads available configuration, evaluates supported controls and presents findings with evidence. It does not read email bodies, file contents or chat messages, and it does not change settings or execute remediation. You sign in on Microsoft’s website; Simiriki does not ask for your password.
Sign-in and website sessions
Microsoft access tokens and device-sign-in secrets stay in server memory. They are not written to assessment reports or sent in the review email link. The browser holds a private session reference. A verified website session expires after twenty minutes; completing the assessment clears its access token. Application consent in Microsoft Entra is separate from this website session and can remain until you revoke it.
Where evidence is kept
New assessments run on Simiriki’s current Windows computer and return results in server memory, without creating assessment report files. Microsoft provides sign-in and configuration APIs; Cloudflare carries public website traffic. You may save a detailed report or prepare a summary in your own email application. Simiriki does not send it automatically. Reports can contain account or resource details: review them before sharing.
Retention and ending a session
New results are held on the server only during the website session. Ending or cancelling clears the session and stops its worker; the verified session otherwise expires after twenty minutes. Save your report before ending. Copies in your browser, downloads or email remain under your control and are not deleted by server expiry. Evidence from earlier file-retaining pilots remains preserved for separate review. This policy covers application assessment data, not guaranteed physical RAM erasure or provider/operating-system log deletion. Contact Simiriki about access, correction or deletion; agree on retention separately for a full engagement.
Your control
Review the application and permissions on Microsoft’s sign-in page. Confirm the connected organization before collection starts. You can cancel the assessment or revoke the application’s consent in Microsoft Entra. Changes to your tenant require a separate scope and approval.
Simiriki · Monterrey, Nuevo León, Mexico. Privacy and data requests: jjdlr@simiriki.com
Return to the read-only assessment →