What we do with the access you give us

The access we ask for

• App-only, and read-first. Scanning uses application permissions, not a user's session. There is no agent to install and no user-facing disruption.
• Consent is per product, scoped and documented. Each product has its own Entra application, declaring only the permissions that product needs. Enabling a further product means a further admin consent — so nothing inherits permissions it has no use for, and revoking one product revokes exactly one.
• Write access is separate. Remediation requires its own explicit consent on top of the read grant. Withdrawing it stops all write paths and leaves your findings and evidence intact.
• Metadata, not content. We read who can reach what, not what your documents and mailboxes contain. Content reaches us only when you send it: DMARC reports delivered to us, the test messages a deliverability check sends, and, in products that accept them, evidence you upload or a Git repository you connect.

How the platform is built

• Tenant isolation. Each tenant owns its own connectors, findings, governance records and history. There is no shared tenant data. Templates may seed a tenant, but instantiated records belong to that tenant.
• Encrypted in transit and at rest. Data is encrypted on its way to and from the platform, and where it is stored.
• Multi-factor sign-in for staff. Everyone at SeQontrol signs in to the platform and to Azure with multi-factor authentication.
• Daily backups. Stored data is backed up every day.
• Tamper-evident audit. The audit trail is hash-chained, so a record that was altered after the fact can be shown to have been altered. Support access through impersonation is recorded in it like anything else.
• An approval gate for providers. Where a managed service provider operates inside your tenant, you can require that their actions are approved first.
• Nothing is overwritten. Controls, desired states, findings, remediations, approvals and waivers preserve their history. Governance decisions overlay the facts; they never rewrite them.
• No fabricated passes. A control that cannot be assessed — no exported logs, an unsupported plane, a missing permission — is reported as "not assessed", with the reason. It is never scored green by default.

This website

Static files, served over HTTPS with HSTS via the host. No cookies, no third-party scripts, no external requests of any kind. The source is public, so any claim on this page can be checked against the code that makes it.

Reporting a vulnerability

Email support@seqontrol.com. Include enough detail to reproduce the issue. We will acknowledge within two working days and keep you informed until it is resolved. We will not take legal action against anyone acting in good faith to find and report a problem, and we are happy to credit you unless you would rather we did not.

Machine-readable contact details are published at /.well-known/security.txt.

Certifications

None yet. SeQontrol does not hold ISO 27001, SOC 2 or any other certification today, and nothing on this site should be read as implying one. What it can show instead is the access it asks for, set out above and in the connection table, and the limits, written down before you have to ask.

Check it against your own tenant

Every product's grant is listed in the connection table on the platform page. When you want to see it for yourself, sign up and connect one product; nothing beyond that product's own grant is asked for until you add another.