Every claim on this page is something you can check — in the consent screen Microsoft shows you, or in your own audit logs.
We do not open documents. We do not read the body of an email, or a Teams message. We hold no Microsoft permission that would let us — no mail read, no file read, no chat read. You can verify this yourself: Microsoft shows you every permission we request before you approve anything, and those are not among them.
What we work from is the audit and sign-in record Microsoft already produces about your tenant: who signed in, from where, what configuration changed, what was shared, which application was granted access.
Sign-in policies go live in report-only mode. Microsoft records who would have been affected. Nobody is blocked until you say so.
Not that an emergency account exists — that it would actually work. If it wouldn't, we stop.
We store the original configuration before changing anything. Restoring it is another click.
Stored and processed on Microsoft Azure, in the United States. The models that write our plain-English explanations run inside Azure too, under our own subscription — no third-party AI provider ever sees your environment, and your data is never used to train a model.
The web application itself is served by Vercel.
Sign-in records, audit events, alerts and scan results are deleted automatically after 90 days. You can set a shorter period. We don't offer a longer one.
If you leave, you have 30 days to export everything, and then we delete it. Deletion is deletion — the records are removed, not hidden.
A limited number of our engineers can reach customer environments in the course of running and supporting the service. Access is restricted to those who need it.
If you believe you have found a vulnerability in VizTime, write to security@viztime.com. We will acknowledge you and keep you informed.
Working through a security questionnaire? Write to security@viztime.com and we will answer it.