Microsoft Entra sign-in
The configured preview supports Entra code flow with PKCE, state and nonce, using existing verified identity links. There is no public self-signup, email auto-linking or general production SSO/MFA guarantee.
01 Security
Trust, by
construction.
Keep your analytics values in your environment. Share signed qualification status.
Preview · Hosted
Your numbers never leave your environment for the Hosted qualification ledger. Customer-approved Fabric execution and external assistant providers have separate data boundaries.
02 The boundary
Share the claim.
Keep the values.
The qualification engine compares values locally. Hosted verifies the registered signer and bindings of a closed attestation, then returns a signed acknowledgement.
Qualification upload · data boundary
03 Integrity and custody
An exact claim.
An inspectable signature.
01 / DISCLOSURE
Value-free attestations
The shared projection contains bounded verdicts, times and keyed commitments. Closed schemas reject unknown or value-bearing fields. Raw local receipts can contain private values; they are not uploaded.
02 / AUTHENTICITY
Ed25519 signatures
Local proof subjects and exported attestations support Ed25519 signatures. Hosted ACKs use a separate pinned signing authority. Signatures authenticate the exact claim and bytes; they do not establish source truth or human acceptance.
03 / CUSTODY
Keys outside the repo
Local signing keys are encrypted outside repositories, using Windows DPAPI/ACL support or scrypt/AES-GCM protection on other platforms. Production custody and disclosure suitability still require review.
04 Identity and access
Identity starts
the check.
Membership, project grants and entitlements each have a separate role.
Exact grants, checked now
Current membership and action-specific project grants are checked alongside entitlements. A role, subscription or OAuth scope alone grants no project access.
Tenant isolation by row-level security
Hosted uses forced PostgreSQL row-level security and a restricted non-owner runtime role. Tenant context comes from verified server identity. This boundary is distinct from customer-model RLS/OLS, which requires observed enforcement contexts to qualify.
05 Secret handling
Secret names in files.
Secret values in a vault.
Our repository practice uses Azure Key Vault, names-only manifests and private human entry. Runtime secrets stay out of artifacts and logs. Signing custody stays outside the repository.
A names-only manifest documents bindings, not values. This practice does not require every customer to use one secret platform, and it does not establish independently audited production controls.
Credentials, private keys and client evidence do not belong in contact messages or design-partner applications.
06 The limits are part of the proof
What we don’t claim yet.
We distinguish implemented controls from independently observed production assurance. Production security publication and compliance claims remain subject to review.
No compliance certifications
No SOC 2 report, ISO certification, GDPR/HIPAA compliance certification or independent security assurance result is established. SOC 2 pursuit remains pending.
No production service guarantees
Production retention, deletion SLA, recovery objectives and regional or legal commitments remain pending approval. Preview evaluation limits are not production service levels.
No universal correctness
Qualification applies to declared checks and current evidence. It does not certify every number or financial interpretation. Hosted does not recompute source truth.
07 Responsible disclosure
Raise a security concern.
Check contact availability for a security concern. Start with a high-level description; omit credentials, private values and raw evidence.
Contact usThe contact channel is awaiting approval. Disclosure service and response commitments remain under review.