Four products you can run today and four on the way: what each one answers, whether it ever writes to your tenant, and what it costs. One console, one findings store and one audit trail underneath all of them.
What each one is for, whether it ever writes to your tenant, and what it costs. Scans, findings, remediation and evidence exports are never metered.
| Product | The question it answers | Writes to your tenant? | Price |
|---|---|---|---|
| ShareCare | What is over-shared, and what can Copilot reach? | Yes — on the Automation tier, where the platform allows it |
per Microsoft 365 user / month
|
| SecurityPortal | Is the tenant configured safely? | No — assessment and evidence only |
per user / month · one tier
|
| WebScan | What do our public-facing systems look like to an attacker? | No — it never writes anywhere |
per monitored site / month
|
| CompliancePortal Coming soon | Can we prove the technical controls held, continuously? | No — it maps, scores, evidences and attests |
per tenant / month · on release
|
| PosturePortal Under development | What do I show the client or the board? | No — read-only by design | in development Not priced while it is still being built. |
| MailTrust | Can someone spoof us, and how do we stop it safely? | Yes — DNS write-back on the Automation tier |
per sending domain / month
|
| Dredd Under development | What changed since we approved this, and who ratified it? | Yes — approval-gated restore of the approved state | in development Quoted, not listed, once released. |
| ConditionalAccessPortal Coming soon | Do our Conditional Access policies actually cover what we think? | Yes — approval-gated policy write-back |
per user / month · on release
|
“Available” means it runs today and you can buy it, and four of the eight are: ShareCare, SecurityPortal, WebScan and MailTrust. “Coming soon” means built and running but not on sale. “Under development” means not yet available. Where a workload is detected but not yet remediable, the product’s own page says so — and the limits page collects every one of these in one place.
Each product that reads your tenant has its own Entra application and asks for its own grant, scoped to what that product needs. So adding a product is a second consent — but never a second integration project, and no product carries permissions it has no use for. Two products need no grant at all: WebScan works entirely from outside, and PosturePortal reads what the others already wrote. What each consent does and does not cover.
Every area below that sits inside a tenant or a cloud account is read app-only, on a schedule, and scored into one findings store; the public web and email-authentication areas are read from outside, with no grant at all. Dashed means detected but not yet remediable app-only — the distinction is stated rather than glossed.
Google Workspace is next. What is not here is not scanned — the full list of what we do not do.
A partner tenant that runs every product on your own tenant, provider rates for MailTrust that pool domains across the book, and pooled CompliancePortal licences that charge once per framework rather than once per client. All of it is published.
Each one answers a question you are probably already being asked, is sold on its own, and the scanning ones feed the same shared findings store. SecurityPortal finds the weaknesses, CompliancePortal maps findings to control frameworks and stores the supporting evidence required by auditors, and PosturePortal puts the picture on one board — two of those three are not released yet, so that loop is not closed until they ship.
What is shared outside, what is over-shared inside so Copilot can reach it, and who can fix it. Crawls seven Microsoft 365 workloads app-only, plus Box and Slack Connect, scores by sensitivity and reach, and remediates with a grace window and undo.
ShareCareMicrosoft 365 and Entra posture, scanned daily or on demand — Conditional Access coverage, MFA enforcement gaps, over-permissioned apps, risky sign-in patterns. Findings carry control tags so they land in CompliancePortal as evidence.
SecurityPortalFinds and grades the public face of your organisation — subdomain discovery, certificate transparency, TLS, headers, cookies, DNS, exposed services and infrastructure. Needs no tenant and no consent, and the scan itself is free with every SeQontrol account; you pay to keep the results.
WebScanSPF, DKIM, DMARC, BIMI and MTA-STS posture, real sender inventory from aggregate reports, a staged path to enforcement, and DNS records written in-product for supported providers.
MailTrustMaps the findings you already produce onto the frameworks you care about, with attestation for the controls that cannot be automated, an evidence repository and time-boxed auditor access. Technical control evidence — not a whole-company compliance programme.
CompliancePortalConditional Access policy inventory and metering, baseline coverage gaps, and approval-gated policy write-back — on the Visibility / Governance / Automation ladder. Its Entra app asks for read scope only until write-back is consented separately. Not released yet.
ConditionalAccessPortalRead-only by design. Aggregates findings, risk scores, trends, connector health and coverage from every product into one per-tenant and fleet-wide board, with saved views and annotations for client and board reporting.
PosturePortalYour approved configuration as a versioned baseline. Every deviation becomes a finding with two answers: revert it, or ratify it into the baseline. Both are recorded, attributed and versioned.
DreddShareCare if Copilot is the question, MailTrust if spoofing is. Each product you add asks for its own consent, scoped to what it needs; the console, findings store and audit trail are already there.