Privacy policy
We're an independent security consultancy, so we take data minimisation seriously. Here's exactly what we collect, what we read, and how long we keep it.
Who we are
Passbeck is an independent security architecture consultancy. For data requests or questions, contact hello@passbeck.com.
The assessment form
If you complete the GSA Impact Assessment, we collect what you type in: your name, work email, company, optional note, and your assessment answers (current stack, scale, and the recommendation you were shown). We use this solely to respond to you and, if you become a client, to scope the engagement. We don't use it for marketing and don't share it with third parties.
The Discovery tool
Discovery is a read-only scanner. When you sign in, you grant these Microsoft Graph permissions — and only these:
User.Read— your name and email, to sign you inDirectory.Read.All— your users and groupsApplication.Read.All— your app inventoryPolicy.Read.All— your Conditional Access policiesAuditLog.Read.All— your sign-in logs (requires Entra ID P1)Organization.Read.All— your tenant name and domains
The analysis runs entirely in your browser. Your data is never uploaded to our servers, never stored, and never seen by us. Nothing persists after you close the tab. You can revoke access at any time from your Entra admin centre.
Retention
Discovery tool: none. We retain nothing — the scan is stateless and client-side.
Assessment form: we keep your submission only as long as needed to respond, and — if you become a client — for the duration of the engagement.
Cookies and storage
We don't use tracking or advertising cookies. The site and Discovery tool may store a single local preference (your dark/light theme choice) in your browser's local storage; it's never sent to us.
Your rights
You can request access to, correction of, or deletion of any personal data we hold about you by emailing hello@passbeck.com. We respond within 30 days.