Privacy policy
We're an independent security consultancy, so we take data minimisation seriously. Here's exactly what we collect, what we read, and how long we keep it.
Who we are
Passbeck is an independent security architecture consultancy. For data requests or questions, contact hello@passbeck.com.
The assessment form
If you complete the GSA Impact Assessment, we collect what you type in: your name, work email, company, optional note, and your assessment answers (current stack, scale, and the recommendation you were shown). Submissions are sent to a Google Apps Script endpoint and stored in a Google Sheet, so your details are processed by Google's infrastructure on our behalf. We use the data solely to respond to you and, if you become a client, to scope the engagement. We don't use it for marketing or share it with anyone else.
The Discovery tool
Discovery is a read-only scanner. When you sign in, you grant these Microsoft Graph permissions — and only these:
User.Read— your name and email, to sign you inApplication.Read.All— your app inventoryPolicy.Read.All— your Conditional Access policiesAuditLog.Read.All— your sign-in logs (requires Entra ID P1)Organization.Read.All— your tenant name and domainsNetworkAccess.Read.All— your GSA forwarding profiles (admin consent)
The analysis runs entirely in your browser. Authentication and data retrieval go directly to Microsoft (Microsoft Graph) with your signed-in account; the tenant analysis is computed locally and Passbeck receives none of it and stores nothing on our side. Tenant analysis is held in memory while the tool runs and only persists if you explicitly download the JSON export. You can revoke access at any time from your Entra admin centre.
Retention
Discovery tool: none. We retain nothing — the scan is stateless and client-side.
Assessment form: we keep your submission only as long as needed to respond, and — if you become a client — for the duration of the engagement.
Cookies and storage
We don't use tracking or advertising cookies. The site stores a single local preference (your dark/light theme choice) in your browser's local storage; it's never sent to us. The Discovery tool additionally keeps a temporary sign-in token in your browser's session storage so you stay signed in while you use it — this is cleared when you close the tab and is never sent to us.
Analytics
We measure how the site is used with a cookieless, first-party beacon. It records only the page path, a small set of events (for example, when an assessment is started or completed), and the hostname of any referring site — no cookies, no IP addresses, no user agents, and no way to identify you across visits. We honour your browser's Do Not Track and Global Privacy Control settings. We use this solely to understand whether the site is working, and never to advertise to you.
Your rights
You can request access to, correction of, or deletion of any personal data we hold about you by emailing hello@passbeck.com. We respond within 30 days.