Securenix · Technix IT AB

Personal data in Securenix

Securenix produces a read-only security health scan of a Microsoft 365 tenant. This page says in plain language which personal data that involves, on what legal basis it is processed, how long it is kept and how it is erased. The field-by-field detail is in the data processing annex.

Who is responsible for what

Technix is the processor for tenant data

Everything Securenix reads in a customer's Microsoft 365 tenant or on-premises environment belongs to the customer. Technix processes it on the customer's behalf, solely to produce the scan and the report, and only for as long as the customer remains in Securenix.

Technix is the controller for its own staff and audit trail

Securenix has no customer log-ins: everyone who signs in is Technix staff, gated by a single Entra security group. Technix is the controller for those sign-ins, for the audit log that records which technician started a scan, created a report link or deleted a customer, and for the evidence that a customer consented.

Which personal data Securenix stores

A scan is a snapshot of security configuration, not of content. Most of what is stored is counts and policy names. Personal data appears only where a finding would be useless without it — a technician cannot fix “an administrator without MFA” without knowing which account it is.

Accounts named in findings

User principal names and display names of administrators without multi-factor authentication, privileged roles held on everyday accounts, users without a registered MFA method (at most 50), accounts that used legacy authentication in the last 30 days (at most 20), guest accounts, licensed accounts without a sign-in for a long period, the tenant's security notification addresses, and Intune device names.
On-premises audits, where used

If a technician runs the on-premises collector with the customer's agreement, the uploaded audit contains Active Directory account names, membership of privileged groups and server names. The whole upload is kept verbatim as evidence.
Technix staff sign-in

Name, user principal name and object id from the Entra id token, held in the session cookie for the length of the session. There is no separate sign-in table, and no IP address or user agent is stored.
Audit log

Which technician did what, when and for which customer: consent granted or revoked, scan started, report link created or revoked, customer deleted. The row keeps the company name so the log still reads after a deletion, and never the deleted customer's personal data.
Consent evidence

When the consent invitation was sent and to which address, when the terms were accepted and the email address given, and when the Global Administrator granted consent in Microsoft 365. It is the record that the customer agreed to the scan.

What Securenix never does

The scan is deliberately narrow. These are guarantees in the code, not statements of intent.

Never writes, changes or deletes anything in a customer tenant — only read permissions are requested, and they are listed in full in the annex.
Never reads content: no mail, no files in SharePoint or OneDrive, no Teams messages, no calendars. Only configuration and reports about configuration.
Never stores access tokens or refresh tokens. A token lives in memory for the length of one scan.
Never records IP addresses or user agents for the shared report link, and uses no third-party analytics, tracking or CDN — every script, style and font is served by the app itself.

Legal basis

Two grounds carry the processing, and for tenant data Technix acts on the customer's instruction.

Article 6(1)(b) — contract

The scan is performed to deliver the service the customer or prospect asked for. The customer's Global Administrator grants the access themselves and can withdraw it at any time from their own tenant.

Article 6(1)(f) — legitimate interest

Access control for Technix staff, the audit log of who did what, and the evidence that a customer agreed to be scanned. Traceability of who has read a customer's security posture is in both parties' interest.

Article 28 — processing on instruction

For tenant data Technix acts on the customer's documented instruction under a data processing agreement; this page and the annex are its description of the processing.

How long data is kept

Scans and findings — until the customer is deleted

Each scan is a complete snapshot and is never rewritten; a new scan is a new run, so the history shows how the posture developed. There is no automatic expiry: the sanctioned way to remove scan data is to delete the customer, which erases every run, finding and piece of evidence.

Shared report links — 14 days by default, 90 at most

An expiry is mandatory and enforced on the server, and a link can be revoked immediately. Only the hash of the token is stored, and each view increments a counter and a timestamp — nothing else.

Audit log — kept

Audit rows survive the deletion they record, which is the point of them. They name the acting technician and the company, never the deleted customer's own personal data.

Consent evidence — kept after deletion

The dates and email addresses of the consent survive the deletion of the customer, so Technix can show that the scan was agreed to. The name, IP address and browser recorded when the terms were accepted are erased with the customer.

Application logs — 90 days

Operational logs in Azure Monitor are kept for 90 days in production. They carry no secrets and no tokens; the token in a report URL is redacted before the request is logged.

Data subject rights

Requests about tenant or on-premises data are answered by the customer as controller; Technix assists as processor and acts on the customer's instruction. Write to the address below and we will handle it together with the customer.

Access

Everything Securenix holds about a customer is visible in the app and can be exported per scan. We can produce the same extract on request.

Erasure

Deleting a customer in Securenix is a hard delete of the whole aggregate: consent records, scans, findings, evidence, report links, on-premises audits and upload tokens. A single audit row remains, without personal data, together with the consent evidence: its dates and the email addresses of the invitation and the terms acceptance.

Rectification

A finding records what the tenant looked like at one point in time and is not edited. Correct the configuration and run a new scan; the new run is the current picture.

Withdrawing access

The customer removes Securenix in their own tenant under Enterprise applications and Securenix loses access at once — no further scan can read anything. Removing what was already collected is the erasure above.

Where the data is

Securenix runs in Microsoft Azure in Sweden. The database uses Entra-only authentication with no SQL log-ins, secrets live in Key Vault and are reached with a managed identity, and all traffic is HTTPS. Securenix itself transfers no data outside the EU/EEA.

Hosting

swedencentral

Sub-processor

Microsoft Azure. No other sub-processor.

Contact

Questions about privacy in Securenix, or a request from a data subject, go to Technix at the address below. The annex lists every source, permission and field.

dpo@technix.se Data processing annex

Last updated 2026-09-10.