Data Privacy & Security

Mission Lens is designed with enterprise security and data privacy as fundamental principles. This document outlines our security architecture, data handling practices, and compliance features.

Security Architecture

Authentication & Authorization

Azure Active Directory Integration

OAuth 2.0 / OpenID Connect authentication
Multi-factor authentication (MFA) support
Conditional access policy enforcement
Single Sign-On (SSO) capability

Role-Based Access Control (RBAC)

Granular permission management
Custom role definitions
Least privilege principle enforcement
Admin, Analyst, and Viewer roles

Session Management

Secure session token generation
Automatic session expiration
Concurrent session limits
Session revocation capability

Data Encryption

In Transit

TLS 1.2+ for all network communications
HTTPS enforcement (HTTP redirects to HTTPS)
Microsoft Graph API connections encrypted
Certificate pinning for critical endpoints

At Rest

MongoDB encryption at rest (Azure Cosmos DB)
Azure Storage encryption (AES-256)
Encrypted backups
Key rotation policies

Key Management

Azure Key Vault integration
Separate keys per environment (dev/staging/prod)
Automated key rotation (90-day cycle)
Hardware Security Module (HSM) backing

Network Security

Azure Infrastructure

Azure Virtual Network (VNet) isolation
Network Security Groups (NSG) for traffic filtering
Azure DDoS Protection
Private endpoints for databases

API Security

Rate limiting per client/IP
API key authentication for service-to-service
Request signing for sensitive operations
CORS policy enforcement

Firewall Rules

IP allowlist for administrative access
Geo-blocking for non-approved regions
Automatic threat detection
Intrusion prevention system (IPS)

Data Privacy

Data Collection

What We Collect

Microsoft 365 metadata (emails, meetings, files)
User profile information (name, email, department)
Usage analytics (feature usage, login times)
Audit logs (who accessed what, when)

What We Don’t Collect

Passwords or authentication credentials
Payment information (billing handled by Azure)
Unnecessary personal information
Data outside of configured scope

Data Minimization

Mission Lens implements data minimization principles:

Selective Extraction: Only extract data types you need
Date Filtering: Limit data to specific time periods
User Filtering: Export only relevant users’ data
Content Filtering: Exclude sensitive content types
Retention Policies: Automatic deletion of old data

Configuration Example:

data_collection:
  types:
    - emails
    - meetings
  date_range:
    start: "2024-01-01"
    end: "2024-12-31"
  users:
    - "department:sales"
  exclude_labels:
    - "Highly Confidential"
    - "Attorney-Client Privilege"

Data Retention

Default Retention Periods

Exported M365 data: 12 months
Analysis results: 24 months
Audit logs: 7 years (compliance requirement)
Session logs: 90 days

Custom Retention

Configure per-data-type retention
Legal hold capability for litigation
Automatic purge of expired data
Data export before deletion

User Rights

Right to access personal data
Right to rectification
Right to erasure (“right to be forgotten”)
Right to data portability

Data Location

Azure Regions

Primary: Based on your tenant location
Backup: Geo-redundant paired region
Data residency compliance
No cross-border data transfer (unless configured)

Data Processing

Processing occurs in same region as storage
AI analysis uses region-specific endpoints
No third-party data sharing
No data used for AI model training

Compliance & Certifications

Data Subject Rights

Access: Users can request their data via self-service portal
Rectification: Incorrect data can be corrected
Erasure: Data deletion requests processed within 30 days
Portability: Export in machine-readable format (JSON, CSV)
Object: Opt-out of specific processing activities

Legal Basis for Processing

Legitimate interest for business analytics
Contract fulfillment for service delivery
Legal obligation for audit logging
Consent for optional features

Data Protection Impact Assessment (DPIA)

Completed and available upon request
Updated annually or when features change
Independent third-party review
Shared with data protection authorities as needed

SOC 2 Type II

Mission Lens infrastructure (Azure) is SOC 2 Type II certified:

Security: Access controls, encryption, monitoring
Availability: 99.9% uptime SLA, disaster recovery
Processing Integrity: Data accuracy, completeness
Confidentiality: Information protection measures
Privacy: Data handling aligned with privacy frameworks

HIPAA Compliance

For healthcare organizations:

Business Associate Agreement (BAA) available
PHI encryption and access controls
Audit logging of all PHI access
Breach notification procedures
HIPAA-trained personnel

Note: HIPAA features require Enterprise plan and BAA execution.

ISO 27001

Information Security Management System (ISMS) aligned with ISO 27001:

Risk assessment and treatment
Security policy framework
Incident response procedures
Business continuity planning
Regular security audits

Security Features

Audit Logging

What’s Logged

Authentication events (login, logout, failures)
Data access (read, export, delete)
Configuration changes
Administrative actions
API requests (with sanitized payloads)

Log Retention

7 years for compliance
Immutable logs (append-only)
Tamper detection
Real-time alerting for suspicious activity

Log Access

Admin role required
Filtered views per organization
Export to SIEM systems
Integration with Azure Sentinel

Threat Detection

Azure Security Center Integration

Vulnerability scanning
Malware detection
Suspicious activity alerts
Security recommendations
Compliance dashboard

Anomaly Detection

Unusual login patterns
Excessive data exports
Off-hours access
Geo-location anomalies
Failed authentication spikes

Automated Response

Account suspension for compromised users
Rate limiting for suspicious IPs
Alert security team
Require re-authentication

Vulnerability Management

Regular Security Assessments

Quarterly penetration testing
Annual third-party security audit
Continuous vulnerability scanning
Dependency updates (automated)

Patch Management

Critical patches within 24 hours
High severity within 7 days
Regular updates monthly
Zero-day response procedures

Responsible Disclosure

security@patchly.com for reporting
Bug bounty program (coming soon)
90-day disclosure timeline
Recognition for security researchers

Data Breach Response

Incident Response Plan

Detection

Automated monitoring and alerts
User reports
Third-party notifications
Regular security reviews

Containment

Isolate affected systems
Revoke compromised credentials
Block malicious actors
Preserve evidence

Notification

Affected users within 72 hours
Regulatory authorities as required
Law enforcement if criminal activity
Media/public if large-scale breach

Recovery

Restore from clean backups
Verify system integrity
Reset credentials
Enhanced monitoring

Lessons Learned

Post-incident review
Update security controls
Staff training
Process improvements

Privacy by Design

Mission Lens implements Privacy by Design principles:

Proactive not Reactive: Security built-in from the start
Privacy as Default: Most restrictive settings by default
Privacy Embedded: Integrated into system architecture
Full Functionality: Security doesn’t compromise usability
End-to-End Security: Lifecycle protection
Visibility and Transparency: Clear data practices
User-Centric: Empowering user privacy controls

User Privacy Controls

Self-Service Privacy Portal

Users can:

View what data is collected about them
Request data export (JSON, CSV formats)
Request data deletion
Opt-out of analytics
Manage consent preferences
View audit log of their data access

Access: Settings → Privacy & Data

Granular Consent

Required: Essential functionality only
Analytics: Usage statistics and improvement
Marketing: Product updates and newsletters (if applicable)
Third-party: Integration features

Consent Tracking

When consent was given
What was consented to
How consent was obtained
Withdrawal capability

Third-Party Security

Microsoft Graph API

Microsoft’s security and compliance applies
Data in transit only (not stored by Microsoft)
API permissions audited regularly
Least privilege permissions

Azure Infrastructure

Microsoft Azure Trust Center compliance
Shared responsibility model
Azure security features utilized
Regular Azure security updates

AI/LLM Services

OpenAI API

Data not used for model training (enterprise agreement)
API data retention: 30 days for abuse monitoring only
Encrypted in transit and at rest
GDPR compliant

Self-Hosted Options

Deploy local LLM models for sensitive data
No external API calls
Complete data isolation
Higher infrastructure cost

Security Best Practices for Users

Account Security

Enable MFA: Multi-factor authentication required for admin accounts
Strong Passwords: Minimum 12 characters, complexity requirements
Regular Password Changes: Every 90 days for admin accounts
Unique Passwords: Don’t reuse passwords across services
Password Manager: Use enterprise password manager

Data Export Security

Encrypt Exports: Use encryption when exporting sensitive data
Secure Storage: Store exports in encrypted, access-controlled locations
Delete After Use: Remove exports when no longer needed
Audit Trail: Log who exported what data
Approval Workflow: Require approval for large exports

Access Management

Least Privilege: Grant minimum necessary permissions
Regular Reviews: Quarterly access reviews
Offboarding: Immediate access revocation when employees leave
Guest Access: Time-limited, restricted permissions
Service Accounts: Separate from personal accounts

Security Contacts

Report Security Issues

Email: security@patchly.com
PGP Key: Available at https://patchly.com/security.txt
Response time: Within 24 hours

Data Privacy Inquiries

Email: privacy@patchly.com
Data Protection Officer: dpo@patchly.com

Emergency Contact

24/7 Security Hotline: +1-XXX-XXX-XXXX (Enterprise customers)

Additional Resources

Last updated: January 2025

This document is reviewed and updated quarterly to reflect current security practices.

Authentication Issues