Security and permissions
Exactly what each of our tools can reach in your tenant, where your data goes, and how to remove it. Written for the administrator or security reviewer who has to approve it.
How we build
Your sign-in, your permissions
Our tools sign in as the person using them, with delegated permissions. They can never do more than that person already can.
Read first, change only when you say
Scanning tools only read. Where a tool can change something, it shows the change first, and the scanners hand you a script to review instead of acting themselves.
Your data stays with you
Most of our tools run in your browser, on your computer or inside your tenant. Results are files you keep. We don't receive copies.
Nothing hidden
No third-party trackers in our tools. This website sets no cookies and loads no advertising scripts.
Tool by tool
Radius
| Runs on | Your administrator's Windows computer (PowerShell 7.4) and their browser. |
|---|---|
| Sign-in and permissions | Their own admin sign-in. A PnP.PowerShell app registration created in your tenant with read-only delegated permissions: SharePoint AllSites.Read, Microsoft Graph Sites.Read.All and Files.Read.All. Purview Content Explorer List viewer to read sensitive-information matches. |
| Your data | The scan writes one file on that computer. The Radius app reads it in the browser and never uploads it. Radius records file names, locations and permissions, never file contents. It only runs read-only commands; fixes are a script your administrator reviews and runs. |
| Removing it | Delete the app registration in Microsoft Entra ID and the scan files. |
Copilot Readiness Scorecard
| Runs on | Your browser. |
|---|---|
| Sign-in and permissions | None. It doesn't connect to your tenant. |
| Your data | Your answers stay in that browser's storage. You can download them as a CSV. |
| Removing it | Clear the site's data in your browser. |
Label Rectifier
| Runs on | Your browser. |
|---|---|
| Sign-in and permissions | None for the tool. The relabel script it generates runs later with your own Microsoft Graph sign-in. |
| Your data | The Content Explorer export you load is processed in the browser and not uploaded. |
| Removing it | Close the tab. |
Keystone Studio
| Runs on | The administrator's Windows PC, opened in the browser. |
|---|---|
| Sign-in and permissions | Delegated only, so it can never do more than the signed-in user: Microsoft Purview Purview.DelegatedAccess, Microsoft Graph User.Read, User.ReadBasic.All and GroupMember.Read.All. Entra ID sign-in with MFA; sessions end after 30 minutes idle. |
| Your data | Directory look-ups stay in memory for the length of a request. Every change is logged and exports to CSV. No third-party scripts, fonts or analytics. |
| Removing it | Delete the app registration. |
DataPulse
| Runs on | Microsoft Teams, in your tenant. |
|---|---|
| Sign-in and permissions | Each person works with their own Purview permissions. An administrator approves access once. |
| Your data | A data-handling sheet is available to early-access customers. |
| Removing it | Remove the app from your Teams app catalog. |
Purview Accelerator Studio
| Runs on | Your browser. Our server only serves the app and the deployment template. |
|---|---|
| Sign-in and permissions | Delegated sign-in through a public app registration with no client secret. You need Owner or User Access Administrator on the Azure subscription. |
| Your data | Your sign-in token stays in the browser tab. The SQL admin password is generated straight into your own Key Vault. Everything it creates lives in a new resource group in your subscription. |
| Removing it | Delete the resource group. |
Project Timesheet
| Runs on | SharePoint Online, as a SharePoint Framework web part. |
|---|---|
| Sign-in and permissions | Acts as the signed-in user. No app registration. |
| Your data | SharePoint lists on your own site, under that site's permissions and retention. Nothing leaves your tenant. |
| Removing it | Remove the app from the site. |
Cloudly Move Assess
| Runs on | Our service, hosted on Cloudflare. |
|---|---|
| Sign-in and permissions | Not applicable: it doesn't connect to your tenant. |
| Your data | Recruiter and candidate details and answers are stored with Cloudflare and deleted 90 days after the invite. Emails are sent through Resend. Details are in our privacy notice. |
| Removing it | Email us to delete your data sooner. |
Reporting a security issue
Email info@cloudlymove.com with "Security" in the subject. We reply within one working day and keep you informed until it's fixed. Our security.txt has the same details.
Cloudly Move Limited, registered in England and Wales, company number 15646622. Registered office: 167–169 Great Portland Street, London W1W 5PF.
Not sure where to start?
Book a 30-minute call and tell us what worries you about Microsoft 365: oversharing, an audit, or a Copilot rollout. Or email us and we'll reply within one working day.