Security

A Microsoft 365 tenant is connected by an administrator of that tenant, who signs in and consents to our application. SecurityScore.me then reads posture data with delegated Microsoft Graph permissions. Every permission is read-only: we cannot change settings, users, policies or devices, and we do not request access to mailbox content, files or Teams messages.

Required permissions

• openid, profile, email, offline_access, User.Read: sign in the consenting administrator and keep the connection active without asking them to sign in again.
• Organization.Read.All: tenant details and licences.
• Directory.Read.All: users, groups and admin roles, for checks such as the number of Global Administrators, guest accounts and disabled accounts.
• Policy.Read.All: Conditional Access policies and security defaults.
• Reports.Read.All: MFA registration reports, to measure MFA coverage.

Optional permissions

These add checks when the tenant has the matching licence. Without them, the related checks are shown as unavailable, not as passed.

• AuditLog.Read.All: MFA registration details.
• IdentityRiskyUser.Read.All, IdentityRiskEvent.Read.All: risky users and risky sign-ins (Microsoft Entra ID P2).
• SecurityEvents.Read.All: Microsoft Secure Score and its recommendations.
• SecurityAlert.Read.All, SecurityIncident.Read.All: Microsoft Defender alerts and incidents, for Security Operations.
• DeviceManagementManagedDevices.Read.All: managed devices and their endpoint protection status.

A customer can end our access at any time: an administrator of the tenant removes "SecurityScore" under Microsoft Entra ID, Enterprise applications, or at myapplications.microsoft.com. This revokes the consent, and the tokens we hold can no longer be renewed. What we delete when an MSP deletes a customer or its organization is described in our Privacy Policy.

• Microsoft 365 access and refresh tokens are encrypted by our application with AES-256-GCM before they are stored. The encryption key is kept in the server environment, separately from the database.
• The tables that hold tokens and Microsoft sign-in state cannot be read through the database API by users; only our server reads them, to call Microsoft Graph.
• Access tokens are short-lived and are refreshed by the server when needed. We never receive or store Microsoft 365 passwords.

• Database, authentication and report files: Supabase, in the European Union.
• Application servers: Vercel, in the European Union.
• Email from the platform (invitations, alerts, digests, reports) is sent through Microsoft 365.

Every service provider that receives personal or customer data, and what each one receives, is listed in our Privacy Policy.

• Each MSP has its own organization workspace. Customers, assets, scans, findings, reports and Microsoft 365 connections belong to that organization.
• Row-level security in the database limits every row to members of the organization that owns it.
• Every API request checks that the signed-in user is a member of the organization and has the role the action needs (owner, admin, analyst, technician or viewer). Report downloads check the organization and the customer again.

• All traffic uses HTTPS. The site sends HSTS (with includeSubDomains and preload), X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy headers.
• Passwords for SecurityScore.me accounts are handled by Supabase Auth; we do not store them ourselves.
• The sign-up, contact and pricing forms use reCAPTCHA, and the contact form is rate limited.
• Secrets such as API keys and the token encryption key are kept in the server environment, not in source code.
• Important actions in a workspace, such as connections, deletions, role changes and accepted risks, are recorded in the organization activity log. Events without a person are kept 90 days, actions by people and critical security events 365 days. The IP address and browser user agent are removed after 30 days.

Domain and website checks read public information: DNS records, TLS certificates, HTTP responses and Certificate Transparency logs. Port checks only test whether a connection can be made; they do not log in or send exploit traffic. Scans run only against the domains, websites and systems an MSP has added to its workspace, and the subdomains found under those domains.

Data is deleted automatically on a fixed schedule. The retention period for each kind of data, and what is deleted when an account, a customer or an organization is deleted, are described in our Privacy Policy.

If we become aware of a security incident that affects your data, we investigate and contain it, inform the affected organizations without undue delay, and notify the authorities where the law requires it. If you suspect that your account or workspace has been compromised, contact us at info@securityscore.me.

If you believe you have found a security vulnerability in SecurityScore.me, please report it to info@securityscore.me with a description and the steps to reproduce it. We will acknowledge your report and work with you to understand and fix the issue. We do not run a bug bounty program, but we appreciate responsible disclosure.

Security or privacy questions: info@securityscore.me. Related policies: Privacy Policy, Terms of Service and Cookie Policy.