Privacy policy

CloudGuard 365 is a Microsoft cloud security monitoring service provided by Conzult Us, based in Eindhoven, the Netherlands ("we", "us"). This policy explains which personal data we process when you use CloudGuard 365 at guard365.conzultus.nl, why, and what your rights are under the General Data Protection Regulation (GDPR / AVG).

1. Who is responsible

For account and usage data, Conzult Us is the controller. For data that CloudGuard 365 collects from a customer's Microsoft tenant, the organisation that connects that tenant is the controller and Conzult Us acts as processor on its instructions, under a data processing agreement.

2. What we process

• Account data: your name, email address and the identifier from the sign-in provider you use (email and password, Microsoft or Google). Passwords are stored only as secure hashes by our authentication provider.
• Organisation data: your organisation, role and the customers and tenants you manage.
• Microsoft tenant security data: configuration, secure score, sign-in and audit information, user principal names, device and alert details read through the Microsoft Graph API with the consent of the tenant's administrator.
• Audit and security logs: actions performed in the console, timestamps and IP addresses, used to keep an immutable audit trail and to protect the service.

When you sign in with Google or Microsoft we receive only your name, email address and profile basics.

3. Why we process it

• To provide the service you or your organisation signed up for (performance of a contract).
• To secure the service, detect abuse and keep audit records (legitimate interest and legal obligations).
• To provide support and inform you about important changes to the service.

We do not sell personal data and do not use it for advertising.

4. AI-assisted advice

If an administrator requests AI advice on findings, the selected findings are sent, with personal identifiers redacted where possible, to our AI provider to generate remediation guidance. The provider may not use this data to train its models. AI advice never changes your tenant configuration.

5. Who we share data with

We use the following processors, bound by data processing agreements:

• Supabase (database and authentication, hosted in the EU – Frankfurt).
• Cloudflare (application hosting and network security).
• Microsoft and Google (only when you choose to sign in with them, and Microsoft Graph for tenant data).
• Our AI provider, only for the AI advice feature described above.

Where a processor is located outside the European Economic Area, transfers are protected by the EU Standard Contractual Clauses or an adequacy decision.

6. How long we keep data

Account and organisation data are kept for as long as the account is active and deleted within 90 days after the account or subscription ends. Tenant security data is deleted when a tenant is disconnected, unless the organisation asks us to keep audit records for a longer legal retention period.

7. Security

Data is encrypted in transit and at rest. Access is isolated per organisation with row-level security, role-based permissions and multi-factor authentication, and every administrative action is logged.

8. Your rights

You have the right to access, correct, delete or export your personal data, and to object to or restrict its processing. For data from a customer's tenant, please contact that organisation first. You can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

9. Contact

Questions about privacy or requests to exercise your rights can be sent to guard365@conzultus.nl.

10. Changes

We may update this policy. The date at the top shows when it was last changed.