Trust Center

Griffin31 helps organizations secure Microsoft 365, and we hold ourselves to the same standard. This page explains how we protect your data and how to request our security documents.

Request documentsReport a security issue

Compliance

SOC 2 Type IIIndependently audited security controlsCompliant

At a Glance

Read-only accessGriffin31 cannot change anything in your Microsoft 365 tenant.

No user contentWe never read or store email messages, files, chats or documents.

Hosted in the EUCustomer data is stored on Microsoft Azure in North Europe.

Your sign-in rulesYou sign in with Microsoft Entra ID, so your Conditional Access applies.

Documents

Request access →

Data Processing Addendum (DPA)Legal agreementPublicSub-processorsThird-party providersPublicSOC 2 Type II ReportAudit reportOn requestPenetration Test SummaryReportOn requestSecurity QuestionnairesCompleted questionnairesOn requestConnector PermissionsMicrosoft 365 permissionsOn requestService Level AgreementSLAOn request

Security Controls

Infrastructure

• Hosted on Microsoft Azure
• Web application firewall on all incoming traffic
• Continuous cloud security posture assessment

Data Security

• Encryption at rest and in transit
• Customer data stored in the EU
• No access to email, files or chats
• Credentials kept in a secure key vault with automatic rotation

Access Control

• Sign-in through your Microsoft Entra ID
• Role-based access inside Griffin31
• Least-privilege access for our team
• Regular internal access reviews

Product Security

• Read-only Microsoft 365 permissions
• Read-only Global Reader role
• No app secrets for customers to create or manage

Secure Development

• Mandatory code reviews
• Automated code and vulnerability scanning
• Security-first development lifecycle

Corporate Security

• Managed, compliant company devices
• Endpoint detection and response
• Continuous security monitoring
• Regular security training for all staff

Frequently Asked Questions

Can Griffin31 change settings in my tenant?

No. Every Microsoft 365 permission Griffin31 uses is read-only, and its directory role is the read-only Global Reader.

What data does Griffin31 store?

Tenant security settings, plus the minimum user information needed for recommendations: user principal names and related Microsoft security signals, such as role assignments, MFA registration and sign-in risk. Email, file, chat and document content is never read or stored. Data is hosted in Microsoft Azure in the EU (North Europe).

Where is my data stored?

On Microsoft Azure in the North Europe region (EU).

How do I get the SOC 2 report?

Request it with the form on this page and we will send it, sometimes under an NDA. Request the SOC 2 report →

Who are your subprocessors?

Griffin31 uses five sub-processors: Microsoft Azure, Microsoft Entra ID, Datadog, Cloudflare and Postmark. The full list, with what each one processes and where, is on our Sub-processors page. We notify account owners 30 days before adding a new one. Sub-processors →

Report a Security Issue

Found a vulnerability in Griffin31? Email us with the details and we'll respond promptly. Please don't share it publicly until we've fixed it.

support@griffin31.ai