Skip to content
Griffin31 Help Center

Trust Center

Griffin31 helps organizations secure Microsoft 365, and we hold ourselves to the same standard. This page explains how we protect your data and how to request our security documents.

Request documents Report a security issue

Compliance

SOC 2 Type II Independently audited security controls Compliant

At a Glance

Read-only access Griffin31 cannot change anything in your Microsoft 365 tenant.
No user content We never read or store email messages, files, chats or documents.
Hosted in the EU Customer data is stored on Microsoft Azure in North Europe.
Your sign-in rules You sign in with Microsoft Entra ID, so your Conditional Access applies.

Documents

Request access →
SOC 2 Type II Report Audit report On request Penetration Test Summary Report On request Security Questionnaires Completed questionnaires On request Architecture & Security Overview Public Platform Security Overview Public Connector Permissions Microsoft 365 permissions Public Service Level Agreement SLA Public

Security Controls

Infrastructure

  • Hosted on Microsoft Azure
  • Web application firewall on all incoming traffic
  • Continuous cloud security posture assessment

Data Security

  • Encryption at rest and in transit
  • Customer data stored in the EU
  • No access to email, files or chats
  • Credentials kept in a secure key vault with automatic rotation

Access Control

  • Sign-in through your Microsoft Entra ID
  • Role-based access inside Griffin31
  • Least-privilege access for our team
  • Regular internal access reviews

Product Security

  • Read-only Microsoft 365 permissions
  • Read-only Global Reader role
  • No app secrets for customers to create or manage

Secure Development

  • Mandatory code reviews
  • Automated code and vulnerability scanning
  • Security-first development lifecycle

Corporate Security

  • Managed, compliant company devices
  • Endpoint detection and response
  • Continuous security monitoring
  • Regular security training for all staff

Frequently Asked Questions

Can Griffin31 change settings in my tenant?

No. Every Microsoft 365 permission Griffin31 uses is read-only, and its directory role is the read-only Global Reader.

What data does Griffin31 store?

Your tenant’s security settings and the directory details the checks need, such as user names, roles and last sign-in times. Never the content of email, files, chats or documents.

Where is my data stored?

On Microsoft Azure in the North Europe region (EU).

How do I get the SOC 2 report?

Request it by email and we will send it, sometimes under an NDA. Request the SOC 2 report →

Who are your subprocessors?

Our subprocessor list is available on request. Request the subprocessor list →

Report a Security Issue

Found a vulnerability in Griffin31? Email us with the details and we'll respond promptly. Please don't share it publicly until we've fixed it.

support@griffin31.ai