Security
How we protect a company’s Microsoft 365 data, and where we still fall short. This page says what is true today. For what we can see and where it lives, read the trust page; for the contract terms, the security sheet and DPA.
Hold as little as possible
Metadata, checksums and text fingerprints. Never file contents.
Read first, write later
The audit is read-only. Write access is a separate consent, asked for when you buy a clean-up.
No secret to steal
Our app signs in to Microsoft with federated credentials. There is no client secret anywhere.
When in doubt, keep the file
Files go to your recycle bin only, a person approves each group, and every move is re-checked and can be undone.
The design in six parts
1. Data. We hold file names, paths, sizes, dates, checksums, owners and sharing state, the duplicate groups and an audit log. Documents are read in memory to compare their wording, and only a fingerprint that cannot be turned back into text is kept.
2. Identity. People sign in with their Microsoft work account. We never see a password. Roles (owner, admin, reviewer, viewer) decide who can approve or start a clean-up.
3. App identity. Our application proves itself to Microsoft with a short-lived token from our host, trusted through an Entra federated credential. A leaked secret that could read many tenants is the worst thing that could happen to a product like this, so there is no such secret to leak.
4. Isolation. Every row carries your organisation id and every query is scoped by it. An automated test suite proves on every change that one organisation cannot read another’s data. The product is built apart from our consumer product: separate hosting project, database and accounts.
5. Clean-up. Removals go to your recycle bin for 93 days and never further. Before each move the live file and its keeper are checked against the analysis, and a file that changed is skipped. A global kill switch and a pause per organisation stop a run between any two moves.
6. Leaving. Remove our app from your Entra admin centre and everything stops within a minute. Your data is deleted 30 days later, sooner on request.
What we do not have yet
- No SOC 2, ISO 27001 or similar certification.
- No independent penetration test yet. One is planned before the first paid clean-up runs.
- No cyber insurance yet.
- No scheduled database backups yet; they come before the first customer clean-up.
- No automatic deletion of an inventory by age; today it goes on offboarding or on request.
- One person runs the service. Support is by email, one business day, with no weekend cover.
CAIQ-lite: security questionnaire
40 questions in the style of the Cloud Security Alliance’s CAIQ, answered from what our code and documents say today. Where something does not exist yet we write “Not yet” or “Planned”. Answered 27 October 2026.
Download as a spreadsheet (CSV)
Data held
| ID | Question | Answer | Detail |
|---|---|---|---|
DAT-01 | Do you store the contents of customers’ files? | No | We hold metadata and fingerprints only. No file contents, previews or thumbnails are stored. |
DAT-02 | What do you store about customers’ files? | Yes | Names, paths, sizes, dates, checksums, owners, sharing state and version counts; the duplicate groups, the keeper, the reason and the action approved; and a MinHash fingerprint of each document’s text, which cannot be turned back into the text. |
DAT-03 | Do you read the text of documents? | Yes | For Word, Excel, PowerPoint, PDF and text files, in memory and with size caps, to compare wording. Only the fingerprint is kept. For a pair of look-alike documents, short passages are sent to the AI provider (see SUB-01); no file names, paths, owners or tenant identifiers go with them. |
DAT-04 | What personal data do you hold about people? | Yes | The names and emails of the admins and reviewers who use the product, their roles, and the owner names and emails that appear in file metadata. Sign-in is Microsoft’s: we never see passwords. |
DAT-05 | How long do you keep data, and is it deleted automatically by age? | Yes | A daily job deletes an organisation’s inventory (file metadata, hashes, signatures, groups and their reviews) 90 days after its last scan, and logs the deletion in the organisation’s audit log. The audit log is kept for the subscription plus one year. Deletion on leaving is automatic (see DEL-01). |
Hosting and regions
| ID | Question | Answer | Detail |
|---|---|---|---|
HOS-01 | Where is the service hosted? | Yes | Application functions on Vercel (USA and EU). Database on Supabase, running on AWS in the EU (Ireland). |
HOS-02 | Can customer data stay in one country or region? | Planned | Not today. South African hosting is offered as an Enterprise option by quote; a Cape Town region for the application is being considered. |
HOS-03 | How are cross-border transfers covered? | Yes | Customer data leaves South Africa. The data processing agreement carries the POPIA section 72 and GDPR transfer terms (standard contractual clauses or equivalent) with each subprocessor outside South Africa and the EEA. |
Encryption
| ID | Question | Answer | Detail |
|---|---|---|---|
ENC-01 | Is data encrypted in transit? | Yes | TLS between your browser and us, between us and Microsoft, and between us and each provider. |
ENC-02 | Is data encrypted at rest? | Yes | By our database and hosting providers (Supabase on AWS, Vercel). We do not add our own field-level encryption on top. |
ENC-03 | Can customers hold their own encryption keys? | No | Keys are managed by the providers. Customer-managed keys are not offered. Session tokens are stored only as SHA-256 hashes. |
Access control
| ID | Question | Answer | Detail |
|---|---|---|---|
ACC-01 | How do users sign in, and is multi-factor authentication supported? | Yes | With Microsoft work accounts (OpenID Connect with PKCE). Whatever sign-in rules and MFA your Microsoft tenant enforces apply; we have no passwords of our own. SAML for other identity providers and SCIM provisioning are not offered. |
ACC-02 | Are there roles? | Yes | Four: owner, admin, reviewer and viewer. Only an owner or admin can start a clean-up. Limiting a reviewer to particular sites is not built yet; roles apply to the whole organisation. |
ACC-03 | How are browser sessions protected? | Yes | An HTTP-only, SameSite cookie holds a random token; the database keeps only its hash. Changing requests need a matching CSRF token. Sessions last 14 days by default. Sign-in, invitation and API requests are rate limited. |
ACC-04 | Is one customer’s data separated from another’s? | Yes | Logically, in one database: every row carries the organisation id and every query is scoped by it. An automated test suite proves on every change that one organisation cannot read another’s data. AI-judgment caches are keyed per organisation. |
ACC-05 | Who at your company can reach production data? | Yes | One person, the founder, with MFA on every operator account. Used only for support and incidents. Looking at one organisation’s run history is a recorded action in that organisation’s audit log. |
Keyless app identity
| ID | Question | Answer | Detail |
|---|---|---|---|
KEY-01 | Does the application hold a secret that can read customers’ Microsoft tenants? | No | It authenticates with federated credentials (Vercel OIDC to Entra workload identity federation). No client secret is stored in hosting, code or on a laptop. |
KEY-02 | Are read and write access separate? | Yes | Two Entra applications. The audit app has read-only permissions. A second, clean-up app with write permissions is consented to only when a clean-up starts. Deleting the clean-up app in your tenant removes write access and the audit keeps working. |
KEY-03 | How does a customer revoke access, and how fast does it take effect? | Yes | Delete the enterprise application in the Entra admin centre. The consent is re-checked at the start of every work chunk (about every minute), so a running scan or clean-up stops and says so. Your data is then scheduled for deletion 30 days later. |
Logging and audit
| ID | Question | Answer | Detail |
|---|---|---|---|
LOG-01 | Is there an audit log customers can see? | Yes | Every review decision, clean-up request, pause, finish and undo is logged. An admin can export the audit log and each clean-up’s per-file actions as CSV. |
LOG-02 | Do your logs contain file names or contents? | No | Application logs carry ids and error text, not file names. |
LOG-03 | Can you export logs to a customer’s SIEM, or hold logs for a set period? | Not yet | No streaming export. Hosting logs follow the hosting provider’s standard retention; we have not set or published our own period. |
Incident response and notification
| ID | Question | Answer | Detail |
|---|---|---|---|
INC-01 | Is there a written incident response plan? | Yes | An internal playbook: contain, assess, notify, record, review. It has not yet been rehearsed as a drill; the rehearsal log is empty. |
INC-02 | How and when are customers told about a breach? | Yes | The account owner is told within 72 hours of us learning of it, with what happened, what is affected and what to do. As your processor we tell you without undue delay so you can meet your own duties. |
INC-03 | Which regulators and laws does the plan cover? | Yes | POPIA section 22 (the Information Regulator and affected people, as soon as reasonably possible) and GDPR Article 33 (the controller notifies its authority within 72 hours; we supply the facts). |
INC-04 | How do researchers report a vulnerability, and what support hours apply? | Yes | By email to work@doppelgone.app (also in security.txt). We reply within one business day. Support is one person, Monday to Friday, South African time, with no phone line and no weekend cover. |
Subprocessors
| ID | Question | Answer | Detail |
|---|---|---|---|
SUB-01 | Which subprocessors handle customer data? | Yes | Vercel (hosting), Supabase (database), TypeSafe (AI judgments on look-alike pairs), Resend (email), Polar (checkout, invoices and VAT). Microsoft hosts your own tenant. The full list is at /legal/subprocessors. |
SUB-02 | Are customers told before a subprocessor changes? | Yes | The account owner is emailed at least 30 days before we add or replace a subprocessor that handles file data. Each is bound by a written data agreement. |
Deletion and offboarding
| ID | Question | Answer | Detail |
|---|---|---|---|
DEL-01 | What happens to our data when we leave? | Yes | The owner asks to leave. Scans and clean-ups stop; the report, audit log and CSVs stay downloadable and the owner can cancel. Everything is deleted 30 days later, sooner on written request. If you remove our app from your tenant, deletion is scheduled 30 days after we find out and the owners are emailed. |
DEL-02 | What is not deleted? | Partly | Files we moved to your recycle bin stay there for 93 days, in your tenant. Polar keeps its own order and tax records. Our database backups age out in the provider’s backup window. A person’s sign-in record stays while they belong to another organisation. |
DEL-03 | Are there regular backups of the database? | Not yet | Paid database backups are planned before the first customer clean-up. We hold no customer data worth backing up before then. |
Clean-up safety
| ID | Question | Answer | Detail |
|---|---|---|---|
CLN-01 | Can the product delete files permanently? | No | Files move only to the recycle bin of your own SharePoint or OneDrive, restorable for 93 days; after that Microsoft deletes them, not us. We never empty a recycle bin. Any item, group or run can be undone from inside the product while it is in the bin, and the restore is checked. |
CLN-02 | When is write access granted? | Yes | Never for the free audit. Only when the admin starts a clean-up, through a separate consent for a separate application, and removable by deleting that application. |
CLN-03 | Is a file checked again before it is moved? | Yes | Yes: the live file and its keeper are compared with the analysis (hash, modified time) and the safety rules are applied again with fresh permissions. A file that changed is skipped. The move carries the file’s version tag, so a change in between stops it. |
CLN-04 | Can the only copy of a file be removed? | No | Every group keeps at least one file, and the keeper must be openable by everyone who could open the copy. Files changed in the last 14 days, on legal hold or retention, or owned outside the tenant are never moved. |
CLN-05 | Does a person approve every removal? | Yes | A reviewer approves or skips each group. Near-identical documents are never pre-selected; only identical files and clear older versions are. The AI judge can only send a pair to review or leave it alone. |
CLN-06 | Can a clean-up be stopped, and what are its limits? | Yes | A global kill switch and a per-organisation pause are checked before every move; a paused run resumes where it stopped. At most 5,000 copies per clean-up. The run stops after 10 failures in a row, or when more than 5% fail once 100 are done. |
Assurance
| ID | Question | Answer | Detail |
|---|---|---|---|
ASS-01 | Has an independent penetration test been done? | Planned | Not yet. One is planned before the first paid clean-up runs; its summary will be available to customers on request. |
ASS-02 | Do you hold SOC 2, ISO 27001 or similar? | No | No. We are a small company and say so. Tell us if procurement requires one and we will say honestly whether and when we could get it. |
ASS-03 | Do you carry cyber insurance? | Not yet | Not yet. A quote is planned alongside the penetration test. |
Report a problem
Email work@doppelgone.app (also in security.txt). We reply within one business day. Is the service up right now? See the status page.
Last reviewed 27 October 2026.