privacy-policy.md

Privacy Policy

Sentavo Pty Ltd (ABN 33 701 245 258) · Sydney, Australia · Last updated: September 2026

We build security tools, so we hold ourselves to the standard we assess others against: collect the minimum, keep it only as long as needed, and be plain about all of it.

1. Who we are

Sentavo Pty Ltd ("Sentavo", "we") is an Australian company providing Microsoft 365 security tools and assessment services at sentavo.works and app.sentavo.works. Contact: hello@sentavo.works.

2. The free tools — your data stays in your browser

The tools on this site (email security grade, header analyzer, Essential Eight check, MFA coverage check and the rest) are built deliberately so that we don't receive your data:

• Everything runs client-side. Analysis happens in your browser tab; results are rendered there and go nowhere else. We keep no copy — when you close the tab, the results are gone.
• DNS-based checks (SPF, DKIM, DMARC, MX) query public DNS records via Cloudflare's DNS-over-HTTPS resolver directly from your browser.
• Sign-in tools (such as the MFA coverage check) authenticate you directly with Microsoft Entra ID using delegated, read-only permissions. Data flows from Microsoft Graph to your browser — not through our servers. We store none of it. You can revoke the app's access at any time in Entra ID → Enterprise applications, and the tool page documents exactly which permissions it requests and why.
• Verify it yourself: open your browser's DevTools → Network tab while a tool runs. What you see is what happens.

3. What we do collect, and why

• Contact form: your name, email, and message — used solely to reply to you.
• Snapshot report: your answers and email address — used to send you the report you requested and, where relevant, follow up about it.
• Engagements: if you become a client, the information reasonably needed to deliver the work and invoice for it (contact details, organisation details, engagement records).

Form submissions are relayed to our mailbox via Resend (email delivery service) and handled in Microsoft 365. We don't add you to marketing lists without asking, and we never sell personal information.

4. Sentavo Assess (app.sentavo.works)

The Assess platform works differently to the free tools, because assessments need to persist to generate reports:

• Account: you sign in with a Microsoft or Google account; we receive your name and email for the account itself. New accounts require admin approval before accessing anything.
• Assessment data: with your consent, Assess reads your Microsoft 365 tenant's security configuration via Microsoft Graph using delegated, read-only permissions — it cannot change anything in your tenant.
• Storage: assessment results are stored (Google Firebase/Firestore) so your reports, HLDs and history work. They're accessible to your account and to Sentavo for support and delivery purposes only.
• Deletion: email us and we'll delete your account and all associated assessment data.

5. Cookies and analytics

No advertising trackers, no third-party ad cookies. We use only what's functionally necessary: authentication state for signed-in apps, and privacy-respecting aggregate analytics (page counts, not people) where our host provides them. Some tools use your browser's local storage to save your own settings on your own device — that data never leaves your browser.

6. Third parties we rely on

Like any modern service, we run on infrastructure providers, each processing data only to provide their service to us: Cloudflare (hosting, DNS), Microsoft (email, identity, Graph APIs), Resend (transactional email), and Google (Firebase authentication and database for Assess). Some of these providers process data on servers outside Australia (typically the United States). We choose providers with strong security postures and share only what each needs.

7. Security and retention

Data in transit is encrypted (TLS); provider-side encryption protects data at rest; access is restricted to what delivery requires; secrets are stored in encrypted configuration, never in code. We keep personal information only as long as needed for the purpose it was collected — correspondence until resolved plus a reasonable period, engagement and invoicing records for the periods Australian tax and corporations law require, and assessment data until you delete it or ask us to.

8. Your rights

We handle personal information in line with the Australian Privacy Principles (Privacy Act 1988). You can ask us at any time to access, correct, or delete the personal information we hold about you — email hello@sentavo.works and we'll respond promptly. If you're unsatisfied with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

9. Changes

If this policy changes, the new version appears here with an updated date. Material changes to how Assess handles tenant data will be flagged in the app before they apply to you.