Security and data handling
Keywicket is read-only by design. This page explains, in plain English, exactly what it reads from your tenant, what it never does, how that's enforced, and what happens to your data.
What Keywicket reads
Directory settings and metadata: users and their admin roles, MFA registration, last sign-in dates, Conditional Access and tenant settings, and the apps that hold access to your tenant.
What Keywicket never does
It never changes anything in your tenant, never reads mail, files or chat content, and never sees or stores a password.
What Keywicket reads, and why
These are all the permissions Keywicket asks for. Each one is read-only. The rule IDs show which checks rely on it; registered customers can see each check's exact API calls in the rules browser.
Microsoft 365 and Entra ID
| Permission | Why Keywicket needs it | Checks that use it |
|---|---|---|
Directory.Read.All | Read directory objects that other permissions don't cover: tenant domains, licence SKUs, group membership counts and delegated permission grants. | ENT-PA-04, ENT-AU-05, ENT-NH-02, ENT-NH-03, ENT-NH-07, ENT-NH-08, ENT-NH-09, X-01 |
User.Read.All | Read user profiles: account type (member or guest), enabled state, creation date, sync source and assigned licences. | ENT-PA-04, ENT-PA-05, ENT-PA-06, ENT-AU-02, ENT-AH-01, ENT-AH-02, ENT-AH-03, X-01 |
AuditLog.Read.All | Read last sign-in dates for users and applications (inactive and never-used accounts) and the MFA registration report. | ENT-PA-02, ENT-AU-02, ENT-AH-01, ENT-AH-02, ENT-AH-03, ENT-NH-07, X-02 |
Policy.Read.All | Read Conditional Access policies, security defaults and tenant authorisation settings (guest invites, app registration, user consent). | ENT-AU-01, ENT-AU-03, ENT-AU-04, ENT-AU-05, ENT-AH-04, ENT-AH-05, ENT-AH-06 |
RoleManagement.Read.Directory | Read who holds directory roles, including PIM-eligible assignments. | ENT-PA-01, ENT-PA-02, ENT-PA-03, ENT-PA-04, ENT-PA-05, ENT-PA-06, ENT-PA-07, ENT-NH-10, X-02 |
Application.Read.All | Read app registrations and enterprise apps: owners, credentials, redirect URIs and the permissions they hold. | ENT-PA-07, ENT-NH-01, ENT-NH-02, ENT-NH-03, ENT-NH-04, ENT-NH-05, ENT-NH-06, ENT-NH-07, ENT-NH-08, ENT-NH-09, ENT-NH-10 |
UserAuthenticationMethod.Read.All | Read the MFA method types registered by admin role holders only (never secrets or phone numbers in reports), so admin MFA can be checked even without Entra ID P1. | ENT-PA-02, X-02 |
openid profile email User.Read | Sign you in to Keywicket with your Microsoft work account and read your name and email. | Sign-in only |
Google Workspace
| Permission | Why Keywicket needs it | Checks that use it |
|---|---|---|
admin.directory.user.readonly | List users: admin flags, 2-Step Verification enrolment and enforcement, suspension, creation and last login dates. | GWS-PA-01, GWS-PA-02, GWS-PA-03, GWS-AU-01, GWS-AU-02, GWS-AH-01, GWS-AH-02, GWS-NH-01, GWS-NH-02, X-01, X-02 |
admin.directory.rolemanagement.readonly | Read admin roles and who they are assigned to. | GWS-PA-04 |
admin.directory.domain.readonly | Read your Workspace domains so the same person can be matched across Microsoft and Google (leaver and admin gaps). | X-01 |
admin.reports.audit.readonly | Read login audit events to check whether super admins sign in with security keys or passkeys. | GWS-PA-03 |
admin.directory.user.security | Optional. Used only to list third-party app tokens (tokens.list) to find apps with high-risk access and AI tools. Keywicket never revokes tokens or changes security settings. | GWS-NH-01, GWS-NH-02 |
openid userinfo.email userinfo.profile | Sign you in to Keywicket with your Google account and read your name and email. | Sign-in only |
If you don't grant the optional Google scope, checks GWS-NH-01 and GWS-NH-02 show "Not assessed: optional scope not granted". Checks that need a licence you don't have (for example Entra ID P1 or P2) show "Not assessed" with the reason.
What it never does
- No write access. Keywicket doesn't request any permission that can change users, roles, policies or apps.
- No content. It never requests access to mail, files, chat messages, calendars or documents.
- No passwords. You sign in with Microsoft or Google; Keywicket never sees your password or anyone else's.
- No remediation on your behalf. It can't lock accounts, revoke access or change settings. Every fix is yours to make.
How read-only is enforced
It's not just a promise. Every request Keywicket makes to Microsoft or Google goes through one shared HTTP client with an allowlist: GET requests to Microsoft Graph and the Google Admin SDK, plus the sign-in token endpoints at Microsoft and Google. Anything else is stopped inside Keywicket before it leaves.
The build also checks the code. If any data-collection code tries to use a method other than GET, or a host outside the allowlist, the build fails and nothing is deployed. There's a test that deliberately tries a POST to prove the check works.
What's stored and for how long
| Data | How long |
|---|---|
| Raw API responses from your tenant (directory metadata) | 30 days, then deleted by a daily job |
| Findings, comments, approvals and reports | Until you delete them, or 30 days after you disconnect the tenant |
| Microsoft connection | Only your tenant ID. Keywicket gets short-lived tokens with its own certificate; no Microsoft token is stored. |
| Google connection | A refresh token, encrypted with AES-GCM using a key held only in Keywicket's secret store. Deleted when you disconnect. |
| Your account (name, email, workspace membership) | While your account exists. Deleted on request. |
| Database recovery history | Cloudflare D1 keeps a point-in-time recovery history for 7 days. Deleted data can still be restored by the operator during that window, then it's gone. There are no other backups. |
Operational logs record job outcomes and error codes. They don't contain directory data.
Where it's stored
Keywicket runs on Cloudflare. Its database was created with Cloudflare's Oceania location hint, so it runs in the Oceania region. That's a placement preference, not a guarantee: Cloudflare may process requests and move data through its global network, including outside Australia and New Zealand.
| Organisation | Role | What it handles |
|---|---|---|
| Cloudflare | Hosting, database, job queue, AI | All Keywicket data. Comment text and help questions are processed by Cloudflare Workers AI. |
| Resend | Email delivery | Your email address and alert or invite content (finding titles and severities, not affected names). |
| Stripe | Billing (test mode during the preview) | Your name, email and billing details, only if you open checkout or the billing portal. |
| Microsoft | Data source and sign-in | Your tenant's directory metadata, read through Microsoft Graph. |
| Data source and sign-in | Your Workspace's directory metadata, read through the Admin SDK. |
AI
Keywicket uses Cloudflare Workers AI for two things: sorting your comments on findings into a category, and a help assistant that answers from Keywicket's documentation. Only the comment text or your question is sent. Directory data is never sent to the AI model.
The model can only return one category from a fixed list; anything else is treated as "Unclear", and it can't change findings, scores or text. Cloudflare states that it doesn't use customer content sent to Workers AI to train AI models or improve its services without explicit consent.
Who can see your data
- People in your Keywicket workspace: you and anyone you invite.
- The operator. Keywicket is run by one person during the preview, who has technical access to the database to operate the service, investigate problems or help when you ask.
- Nobody else. Keywicket doesn't sell data, use it for advertising, or share it beyond the organisations above.
Disconnecting and deleting
In Settings, Disconnect stops scanning and immediately deletes raw directory data and any stored Google token; findings and reports follow after 30 days. Delete all data now removes everything for that tenant at once. If you revoke consent in Microsoft or Google, Keywicket detects it and disconnects automatically. To delete your account entirely, email keywicket@vdbs.net.
How Keywicket protects itself
- Every operator account (code, hosting, identity, billing and email) uses multi-factor authentication.
- Keywicket's Microsoft app authenticates with a certificate, not a password-style secret. Secrets live only in the hosting provider's encrypted secret store.
- Dependencies are updated automatically, and every change must pass the test suite before it's deployed.
- Keywicket runs its own checks against its own Microsoft tenant.
- The public site loads nothing from third parties: no trackers, analytics or external fonts.
If something goes wrong
If a data breach is likely to cause serious harm, Keywicket will notify affected customers without undue delay and follow the Notifiable Data Breaches scheme in Australia and the notifiable privacy breach rules in New Zealand. To report a vulnerability, see security.txt or email keywicket@vdbs.net.
Reporting a vulnerability
If you think you've found a security problem in Keywicket, please email keywicket@vdbs.net with the details and steps to reproduce it. You'll get an acknowledgement within 5 business days.
- In scope: keywicket.vdbs.net and Keywicket's Microsoft and Google app registrations.
- Please only test against your own account and tenant. Don't access, change or delete other people's data, and stop as soon as you've confirmed an issue.
- No denial-of-service testing, spam, social engineering or physical attacks.
- Give us a reasonable chance to fix the issue before you disclose it publicly.
If you act in good faith and follow these guidelines, Keywicket won't take legal action against you for your research. There's no paid bug bounty during the preview, but we're happy to credit you.
What Keywicket is not
- Not an audit. Control references are indicative, not an audit or compliance attestation.
- Not incident response or threat detection. It reviews configuration and hygiene; it doesn't watch for attacks in real time.
- Not a replacement for Microsoft's or Google's own security tools.