Nothing leaves your tenant.
It runs inside your Microsoft tenant, reads metadata only and sends us nothing. You decide what to share.
In short
The Governor runs inside your Microsoft tenant, reads metadata only, never changes your tenant and sends nothing to Ustrema. You copy out an anonymised summary when you choose to, licence codes are signed and bound to your tenant, and your security team can read the source.
How does The Governor stay safe?
The app measures facts in your tenant and our judgement stays in ours. Six controls make that true by design rather than by promise.
No outbound calls
No connector to Ustrema and no telemetry. The summary leaves only when your admin copies or emails it. A recommended data policy blocks other outbound calls.
Read-only collection
Metadata under your own admin connections. The app writes only to its own tables and never changes your tenant; fixes happen in Microsoft's portals.
No personal data shared
The summary never contains names, emails, IDs or content. Environment and site names are anonymised unless you choose to show them.
Signed and bound to you
Licence codes and frameworks are signed and work only in your tenant. A tampered or foreign file is rejected.
Source available
Your security team can read the client app's code, matched to the release you install.
EU people, EU systems
Our workspace runs in the EU. The consultants who work with you are EU-based and under NDA.
What does the summary contain?
Only counts and settings that describe your estate, never the people or content in it:
- Counts of environments, apps, flows, agents and connectors, by type and region
- Tenant settings, data policy coverage and Managed Environment settings
- Credits and licences as totals, never per person
- Your questionnaire answers
What does it never contain?
The summary is built to describe the estate, so anything that identifies a person or a piece of content is left out:
- Names, email addresses, user IDs or object IDs
- App, flow or agent names, or any document, message or record content
- Anything from SharePoint sites or mailboxes that no app or agent uses
How long are results kept in our tenant?
Every weekly check result stays in your tenant, by default for 36 months. Each result carries a hash of the one before it, so an edited record shows up when the chain is verified. Corrections are new records; nothing is overwritten.
What does the agent usage read collect?
Nothing unless you switch it on: it is off by default. When your owner turns it on, a weekly read of the Purview audit log keeps only counts per agent: conversations, distinct users, jailbreak and prompt-injection detections and when it was last used. User IDs, file names and site names are never stored.
Where is our copy kept?
Only what you paste reaches us. It is stored per engagement in our EU workspace, visible only to the consultants assigned to you, and deleted 90 days after the engagement closes unless the contract says otherwise.
Questions security teams ask
Who at Ustrema can see our data?
Only the consultants assigned to your engagement, and only what you chose to paste. Every read is logged.
Do you use AI on our data?
Not in the app: The Governor itself uses no AI. In our workspace, Anthropic's Claude drafts text and helps consultants with the steps for each task, citing Microsoft Learn. It sees counts, aliases and your decisions, never names, user IDs or content, and it never decides findings, severity, scope, hours or prices. A consultant reviews everything you see.
Do we need Agent 365?
No. Agents are read from the Power Platform inventory, Dataverse, Entra Agent ID and the Teams app catalog. Where you already have Agent 365, The Governor reads its catalog too.
How do your consultants get into our tenant?
As named guest accounts, one per person, with admin rights only through your own PIM or approval process. You can revoke them at any time.
Sources
The primary documentation and law this page relies on. Each link opens the original source.