Privacy Policy

This policy explains what Tenant Strike — operated by Boltaic LLC, a Texas limited liability company doing business as Tenant Strike (“we”, “us”) — collects when you visit tenantstrike.com, use the Tenant Strike dashboard, or connect a Microsoft tenant for scanning — and why we collect it, who we share it with, and how long we keep it.

For the data our scanner reads from your tenant, your organization decides what we process and remains the owner of that data; we process it on your instructions to provide the service. If your organization needs a data processing agreement, email [email protected].

Account data. When you sign up: your name, work email address, and organization/tenant name. If teammates are invited, the same for them.

Tenant configuration data. When your administrator grants consent, we read security-relevant configuration through Microsoft’s Graph and Azure Resource Manager APIs using read-only permissions — every endpoint we call is published on our trust page. This includes things like sign-in and MFA policies, admin role assignments, email authentication records, sharing settings, app-consent grants, device compliance status, and Azure resource configuration. Some of it is personal data about your tenant’s users — names, email addresses, roles, and security status (for example, “this admin account has no MFA”). We never read the contents of files, mailboxes, messages, or chats — the permissions we hold don’t allow it.

External attack-surface data. For domains and portal URLs you list, we collect publicly observable information: DNS records, TLS certificate details, certificate-transparency history, exposed ports and service banners, and security headers.

Free scan data (no account needed). If you run a free scan at our external scanner, we store the domain you entered, the results we found, and — if you choose to unlock the full list — the email address you give us. We keep a one-way hash of your IP address to enforce rate limits and prevent abuse; we do not store the address itself. The scan uses only published information about the domain (public DNS, domain registration, certificate-transparency logs, and files the domain serves publicly). Giving us an email address is optional — the scan runs without it. Section 03 says what we send to it and how to stop.

Billing data. Payments are processed by Stripe. We store your Stripe customer and subscription identifiers and your plan status — your card details go to Stripe, never to us.

Usage and log data. Standard server logs (IP address, browser type, pages requested) and an audit log of significant actions in your account (who ran a scan, who changed a setting), kept for security and support.

Cookies. The dashboard uses cookies strictly to keep you signed in. The marketing site (tenantstrike.com) sets no analytics or advertising cookies and runs no third-party trackers.

• –run scans, generate reports, and track configuration drift over time;
• –send you service email — scan results, drift and vulnerability alerts you've enabled, billing notices, and important account or policy updates;
• –provide support when you contact us;
• –send you the results of a free scan you asked for, where the address is at the scanned domain, and may follow up about Tenant Strike afterwards — see below;
• –bill you and prevent abuse of the service;
• –secure, debug, and improve the service.

The address you give a free scan. We send the results to it, and we may follow up about Tenant Strike. That follow-up is a person writing an email — we don’t run a newsletter and there is no automated sequence. Every message we send carries an unsubscribe link that works in one click, with no account and no sign-in, and we stop when you use it.

Some addresses reached us when the form said the results were the only email we’d send. We keep the wording that was on screen alongside the address, and the addresses that were promised nothing further don’t get follow-up.

We do not sell your data, use it for third-party advertising, or use your tenant data to train machine-learning models. We may publish aggregated, anonymized statistics (for example, “X% of tenants we scan have no DMARC policy”) that identify neither you nor your tenant.

We share data only with the providers needed to run the service:

• –Microsoft — our infrastructure runs on Microsoft Azure, we read your tenant through Microsoft’s APIs, and notification email is delivered through Microsoft 365. Your scan data is stored on Azure.
• –Stripe — payment processing. Stripe receives your billing details directly; see Stripe’s privacy policy for how they handle them.

To assess your external attack surface, we also query public data sources about the domains you list: certificate-transparency logs (crt.sh), internet-scan datasets (Shodan/InternetDB), and DNS resolution via Cloudflare’s DNS-over-HTTPS service. These lookups send those services your domain names or IP addresses (information already public in DNS), and only public data comes back. Threat-intelligence feeds we use (such as abuse.ch blocklists) are downloaded in bulk — nothing about you is sent to them.

Beyond that, we disclose data only if required by law (we’ll notify you unless legally barred), to protect the rights or safety of Tenant Strike or others, or as part of a merger or acquisition — in which case this policy continues to apply to your data and we’ll notify you of any change in ownership.

Access to your tenant uses Microsoft’s OAuth admin-consent flow with read-only permissions — we never see or store your users’ passwords, and you can revoke our access at any time from your Microsoft admin center. Data is encrypted in transit (TLS) and at rest on Azure, application secrets are stored outside the codebase, and internal access to customer data is restricted to the people who operate the service and logged. No system is perfectly secure; if a breach affects your data, we will notify you without undue delay.

• –Scan data and history — kept while your account is active (that history is what powers drift detection), and deleted within 30 days after you close your account or ask us to delete it.
• –Account and audit data — kept while your account is active and for a short period afterward for security and support, then deleted.
• –Billing records — kept as long as tax and accounting law requires.
• –Free scan results — kept for up to 30 days and then deleted automatically. That store also holds a fixed number of recent scans and drops the oldest first, so a busy stretch can clear a result before its 30 days are up; running the scan again is free. If you gave us an email address with a scan, we keep that contact record until you ask us to delete it. When you unsubscribe we stop emailing you and keep the address marked as unsubscribed, because forgetting it entirely is how a person ends up being emailed a second time.

Residual copies may persist briefly in encrypted backups before those backups are rotated out.

Email [email protected] to access, correct, export, or delete the personal data we hold about you, or to object to or restrict our processing of it. We honor these requests regardless of where you live, subject to verifying that you are the account holder. If your users exercise privacy rights with your organization for data we process on your behalf, we’ll help you fulfill those requests. You can unsubscribe from alert email in the dashboard; service email essential to your account (like billing notices) continues while your account is open. If you don’t have an account and gave us your address through a free scan, use the unsubscribe link in any message we send (section 03); it applies to the address, not just to the message it arrived in, so running a second scan doesn’t put you back on. You can also email us to be removed, and we’ll do it whether or not you can still find the link.

The service is for businesses and not directed to children under 16; we don’t knowingly collect their data.

If we change this policy materially, we’ll notify you by email or in the dashboard before the change takes effect. The latest version always lives at this page, with the date at the top.

Privacy questions, requests, or concerns: [email protected]. A human reads it, usually the founder.

Postal mail: Boltaic LLC, 5900 Balcones Drive STE 100, Austin TX 78731.