Security Overview

License Maxing is built for IT and platform teams, so it's designed to be the kind of vendor you'd approve yourself.

Architecture

• Hosted on Microsoft Azure. The application, database, background workers, and email service all run inside Azure — the same cloud your M365 data already lives in.
• Data in transit is TLS-encrypted end to end; traffic terminates at Azure Front Door with a web application firewall in front of the application.
• Data at rest lives in Azure Database for PostgreSQL with encryption at rest. Secrets (connection strings, API keys, your tenant's credentials) are stored in Azure Key Vault, not in application configuration.

Tenant access

• Access to your Microsoft 365 tenant uses application permissions granted by your admin's consent — you can review the exact list in Connect Microsoft 365 and revoke consent from your Entra portal at any time.
• Day-to-day operation is read-only. Write operations (offboarding, license changes) run only when a member of your organization explicitly executes them.

What we store

• Directory basics needed for reporting: names, emails, departments, license assignments, and aggregated usage metrics per user.
• We do not read or store message content, file contents, or calendars — usage reports are counts and sizes, not content.

Auditability

Every material action — syncs, invitations, membership changes, offboarding executions, savings-plan executions, notification sends — is written to an organization-scoped audit log visible to your admins.

Application access

• Organization access is invitation-based with role separation (owner / admin / member).
• Enterprise organizations can enforce sign-in through their own identity provider with Entra SSO and directory sync; removing a member revokes their sessions immediately.

Questions, or need a security review packet for procurement? Contact us.