Your data

What is stored

Everything lives on EU infrastructure in Frankfurt. The complete inventory:

• Account — your email, organization name, plan, trial end date, and the country you declared. Payment details live at Stripe; we hold only the customer and subscription identifiers.
• Connection — tenant ID, display name, subscription IDs, scan schedule, alert thresholds and budgets, report recipients, your ignored findings with their reasons, your per-VM commitment decisions with the note and author, and which Azure roles were found granted to us beyond Reader.
• Notification channels — the email addresses you nominate. A chat webhook URL is stored write-only: never displayed again, never returned to your browser, and redacted even from your own export.
• Per scan — findings (title, category, severity, resource ID and name, estimated saving, fix guidance), totals by category and severity, and bounded cost aggregates: spend totals and trend, rollups by subscription, resource type, resource group and tag, the top 200 resources by cost, and per-VM usage for the commitment comparison. Plus one PDF in a private bucket.
• Activity — an audit log of what changed in your organization, with the email of whoever changed it.

What is never stored

Credentials of any kind. Metric time series. Log content. Network data. A full resource inventory. The access tokens used to read your tenant live for about an hour in memory during a scan and are never written down.

This is a design constraint, not a policy promise: the scanner reduces what it reads to findings and aggregates before anything is persisted.

How long it is kept

Scan history is bounded on purpose, by two limits — whichever applies first:

• The 20 most recent scans of a connection keep their findings and cost detail. Older ones fall back to summary figures.
• 24 months. After that, the detail and the report PDF are deleted outright — whether or not the connection is still being scanned.

Your most recent scan is exempt and is kept for as long as the connection exists, however old it gets. It is your current picture of that tenant, not history — someone who scans by hand once or twice a year should not sign in two years later to an empty account.

What survives is each scan's summary: finding count, savings, spend, totals by category. No resource names, and enough to keep the trend chart and the "eliminated since first scan" figure intact for the whole life of the account.

Failed scans are removed after 30 days — they hold no result worth keeping.

If you need a report for longer than 24 months, download the PDF or the CSV and keep it yourself. The Reports tab carries the same note.

Exporting everything

Settings → Organization → Download your data (JSON) gives an Admin a single machine-readable file with the organization record, members, connections, scans, findings, cost snapshots and alerts, the audit log, and time-limited download links for the report PDFs. That is the GDPR Art. 20 portability export, and it is self-service — no ticket, no waiting.

Individual scans can also be exported as CSV, and reports as PDF, from the Reports tab.

Deleting — three different actions

They are deliberately separate, because they mean different things.

Delete a connection

Tenant → Settings → Danger zone, Admin only, with a confirmation naming the tenant. Removes the connection and everything derived from it: all scans, all findings, all stored PDF reports. Your organization, team and other tenants are untouched.

Delete the organization and account

Settings → Organization → Danger zone, Admin only. You must type delete to confirm, and you must be the only remaining member — remove the others first. It removes every connection, every scan and finding, all report PDFs, your uploaded logo, the audit log, and your login.

One exception, in your favour: if your login also belongs to another organization, the login itself is kept so you are not locked out of that one.

Revoke on your side

The one that does not depend on us at all. Delete the TenantThrift enterprise application in your Entra tenant, or remove the Reader assignment, and access ends immediately. No ticket, no notice period, nothing to wait for.

Note that deleting a connection here does not revoke the Azure side — that grant is yours, and only you can withdraw it. Doing both is the clean exit.

The legal documents

The privacy policy covers lawful basis and your rights, the DPA lists subprocessors and is the document your procurement team will ask for, and the terms govern the service itself.