What we collect, and why

Who is responsible

SeQontrol is operated by JeffOps, Hermesburg 29, 3437 HG Nieuwegein, The Netherlands, registered with the Dutch Chamber of Commerce (KvK) under number 99353946. For anything on this page, including a request to see or delete what we hold, write to support@seqontrol.com and a person will answer.

Where this policy says "we", it means that entity and nobody else. No data described here is sold, brokered, or handed to an advertising network.

This website

The site is static. It sets no cookies, runs no advertising or profiling scripts, and makes no third-party requests — no fonts, no CDN, no embedded video. Nothing about you is collected by visiting it.

If you send the contact form, we receive what you typed: your name, email address, and whatever else you chose to add. We use it to reply to you and to keep track of the conversation. We do not sell it, share it for marketing, or add you to a list you did not ask for.

What the product reads

Once you connect a Microsoft 365 tenant, SeQontrol reads configuration and metadata, mostly through app-only Microsoft Graph permissions, with some planes (Exchange administration, DNS) connected separately, in order to produce findings. Concretely, that means things like sharing links, permission assignments, group memberships, application consents, Conditional Access policies and DNS records.

It is metadata about access, not the contents of your files. SeQontrol records that a document is shared with an external address; it does not read the document.

Content reaches SeQontrol only when you send it: DMARC reports delivered to the mailbox we provide for them, the test messages a deliverability check sends and receives, and, in products that accept them, documents you upload as evidence or a Git repository you connect. It is kept and deleted with the rest of your findings and evidence.

Scanning is read-only. Anything that writes back to your tenant — revoking a permission, publishing a DNS record, restoring an approved configuration — requires a separate, explicit consent that is distinct from the read grant, and can be withdrawn without losing the findings and evidence you already hold.

Where it is kept

Everything SeQontrol stores about your tenant — findings, evidence, scan history and the audit trail — lives in Microsoft Azure, in the EU. It is not replicated to a region outside the EU.

Two things that follow, and are worth being explicit about. Microsoft is therefore a processor for the hosting itself. And the data in your own Microsoft 365 tenant never moves — SeQontrol reads it where it already is; what lives in Azure is the findings and evidence produced from that reading, not a copy of your estate.

Who else handles it

Two subprocessors, and only two:

• Microsoft (Azure) — hosting, storage and the platform itself, in the EU, as above.
• Stripe — payments. Card details go to Stripe and never reach us; we see what Stripe reports back about a payment, not the card.

If that list changes, this page changes with it, and the change is visible in the site’s public history.

How long it is kept

Findings and evidence are retained for the period your licence sets, because the value of compliance evidence is that it covers a period. While you hold a subscription, the audit trail is hash-chained and append-only by design: entries are not edited or deleted, which is the property that makes it worth having.

When a subscription ends, what SeQontrol holds for that tenant is deleted, the audit trail included. Export what you want to keep before the end date.

Contact-form correspondence is kept for as long as the conversation is useful, and deleted on request.

Underneath all of this is the law we operate under, which is Dutch and European: personal data is kept no longer than the purpose it was collected for needs, as the GDPR requires, and no shorter than Dutch law requires. That adds one record which outlives a subscription: invoices and payment records, which Dutch tax law requires us to keep for seven years. They say who paid what, and when; nothing from your tenant is in them.

Your SeQontrol account

To run an account we keep the names and email addresses of its users and of people you invite, such as auditors, a record of sign-ins, support correspondence, and invoices and payment records. We use it to give you access, to support you and to bill you: for you, because our agreement requires it; for the people you invite, because we have a legitimate interest in giving them the access you asked for; and for invoices, also because Dutch tax law requires it. For this data we are the controller.

It is kept while the account exists and deleted when the account is closed, except invoices and payment records, which are kept for seven years.

Your rights

You can ask what we hold about you, ask for it to be corrected, ask for it to be deleted, or object to it being processed. Email support@seqontrol.com and you will get a reply from a person.

Where SeQontrol processes data from your tenant, you are the controller and we act as processor on your instructions. A data processing agreement is available on request.

Changes

If this notice changes materially, the change is visible in the site's public commit history — the whole site is a public repository, which is a stronger guarantee than a "last updated" date we control.

What each product reads

The grant each product asks for, and what it can and cannot see, is set out product by product in the connection table on the platform page.