How we access your Microsoft 365, where your data lives, which providers we use, how we use AI, and what happens if something goes wrong or you leave.
We reach your tenant through Microsoft's partner access (GDAP) with only the admin roles your services need, reviewed every quarter and removed when you leave.
Every Evisent account uses multi-factor authentication.
Automations and Evisent Insights, which handle email, files, finances and client records, run inside your own Microsoft 365 tenant. Never in ours.
Our Practice Automation products use rules and Microsoft-native tools. We use AI for our own internal work and say so openly.
If an incident affects your data, we tell you within 24 hours of finding it and help you assess your notifiable data breach duties.
What we build lives in your tenant. When you leave, we remove our access and delete what we hold, and the lists, flows and policies stay yours.
We use Granular Delegated Admin Privileges (GDAP), Microsoft's partner access model. You accept the relationship, you can see every role we hold in your admin centre, and you can end it at any time. These are the roles Practice Automation needs; managed IT clients agree their full role set at onboarding.
| Role | Why we need it | Used for |
|---|---|---|
| Exchange Administrator | Mail flow rules and retention on mailboxes | Payment and instruction guards, email filing |
| Security Administrator | Anti-phishing and impersonation protection | Payment and instruction guards |
| Compliance Administrator, eDiscovery Manager | Purview retention, data loss prevention and content search | Exposure sweeps, retention |
| SharePoint Administrator | Creating sites and lists | Registers, project and job setup, CPD tracker |
| Teams Administrator | Creating channels for alerts and projects | Project and job setup, alerts |
| Cloud Application Administrator | Creating app registrations for our products, and consenting the Evisent Live app | Automations, Evisent Live readings |
Your email, files, finances and client records never leave your Microsoft 365 tenant. The only thing we hold about you is what we already see as your IT provider: user names and email addresses, device and licence counts, and the status of your security tools.
| Data | Where | How long |
|---|---|---|
| Your email, files and records | Your Microsoft 365 tenant, Australian data location (checked at onboarding) | As you decide |
| Practice Automation: the automations, their logs and outcomes | Your Microsoft 365 tenant | As you decide |
| Evisent Insights: finances, projects, communications, staff availability | Your Microsoft 365 tenant only | As you decide |
| Evisent Live: user names and email addresses, device, licence and security-tool status | Evisent's Microsoft Azure, Australia East | Daily snapshots 13 months, evidence packs 7 years; deleted within 30 days of exit |
| ID verification results (AML pack, in validation) | An Australian-hosted verification provider chosen with you to suit your requirements, and your client file | 7 years, per AML/CTF record keeping |
| Device security telemetry (managed IT clients) | Our security providers' platforms, mostly in the United States; see below | Per vendor retention |
| Notes and tickets about your systems | Our service desk in Australia and our documentation platform in the United States; see below | For the life of the relationship |
| Website enquiries | Our website providers, listed below; some outside Australia, as our privacy policy explains | As our privacy policy sets out |
Evisent Live reads configuration and status from your Microsoft 365 and security tools every morning. It is read-only, and it has no permission to read mail, files or SharePoint.
| Microsoft Graph permission (read-only) | What it is used for |
|---|---|
User.Read.All | Users, to count who is covered |
AuditLog.Read.All | MFA registration status |
Policy.Read.All | Conditional Access policies |
GroupMember.Read.All | Who is in the groups a Conditional Access policy includes or excludes, so MFA coverage is counted per person |
DeviceManagementManagedDevices.Read.All | Intune devices: compliance and encryption |
DeviceManagementConfiguration.Read.All | Intune compliance policies |
SecurityAlert.Read.All | Open Microsoft 365 security alerts |
SecurityEvents.Read.All | Microsoft Secure Score, shown as a benchmark |
IdentityRiskyUser.Read.All | Risky users (where Entra ID P2 is licensed) |
IdentityRiskEvent.Read.All | Risky sign-in detections |
No Mail, Files or Sites permissions are requested. Security tools (endpoint protection, detection and response, application allowlisting, patching) are read through their own read-only API keys.
| Question | Answer |
|---|---|
| Where is it hosted? | Microsoft Azure, Australia East. The app's static front end is served from Microsoft's global edge; the data is not. |
| How long is it kept? | Daily snapshots for 13 months. Evidence packs for 7 years. |
| Who can see it? | Evisent staff, signed in with Microsoft Entra and on an allowlist. Client login is In validation: piloting with managed clients, rolling out to all managed clients in early 2027. |
| Who else can see it? | Only people you share it with: read-only links that expire, with every open logged and revocable at any time. Shared views show counts and percentages, with staff names left off by default. |
| Does AI read it? | No. Collection and scoring are plain code. No AI reads client data. |
None of our Practice Automation products uses AI on your client content. They run on rules and Microsoft-native tools, so every decision can be explained, which matters under the Privacy Act transparency rules from 10 December 2026.
We use AI tools, including Anthropic's Claude, for internal work such as drafting and research. Your client data does not go into those tools.
If you want Microsoft 365 Copilot or another AI tool, we can license, configure and secure it for you, and we help you set the data rules first.
Enquiries sent through our ask and booking forms are not processed by AI. Our retired AI readiness quiz used Anthropic's Claude to prepare reports; it has been switched off.
We use as few providers as we can, and only for what each one does best.
| Provider | What for | Whose data | Where |
|---|---|---|---|
| Microsoft (Microsoft 365, Azure) | Your tenant; our automation service | Your client data | Australia |
| Endpoint detection and response provider | Detecting and responding to threats on devices | Device telemetry | United States |
| Application control provider | Allowing only approved software to run | Device telemetry | United States |
| Patch management provider | Keeping operating systems and applications up to date | Device and software inventory | United States |
| Microsoft 365 management platform | Microsoft 365 standards and drift checks, hosted by Evisent | Tenant configuration | Australia (Microsoft Azure, Melbourne) |
| Service desk platform | Tickets and projects | Support records | Australia |
| IT documentation platform | Documentation | System configuration notes | United States |
| ID verification provider (AML pack) | ID, sanctions and PEP checks | Your clients' identity data | Australia. Provider chosen with you, to suit your requirements |
| Email delivery provider | Delivering website enquiries to our inbox | Website enquiries | United States |
| Cloudflare | Website hosting and enquiry database | Website enquiries | Website served from a global network; enquiry database in the Oceania region |
| Google, Microsoft Clarity and Microsoft Advertising | Website analytics and advertising measurement | Website visit data | Outside Australia, typically United States |
| Anthropic | Our internal work | Evisent's own material, not client data | United States |
Send it to us. Licensees, insurers and auditors ask the same questions, and we would rather answer them in writing than leave you guessing.