Security
Built for people who ask the hard questions.
Whether IT signs off on it or you approve it yourself, Presify is built to the standard a security review expects: read-only, tenant-isolated, encrypted, and audited.
- Read-only Microsoft consent
- Nothing installed
- Guests never tracked
Controls mapped to SOC 2 criteria, security packet on request.
What Presify can access
What Presify reads
- Teams presence and activity
- Names and groups
- Outlook time zone and working hours
What it never reads
- Messages
- Chats
- Call content
- Files
- Calendar content
- Screens
- Keystrokes
Microsoft Graph permissions
Four read-only application permissions, approved once by a Microsoft 365 admin, plus the delegated User.Read that each person grants when they sign in. Select one to see what it allows.
- What it allows, and what Presify uses
- Microsoft grants read access to every user’s Teams presence, which also carries their status message, out-of-office message and work location. Presify reads it only for the people you monitor, keeps only availability and activity (Available, Away, Busy, Offline, and the activity behind it), and discards the rest as it arrives.
- What it never gives Presify
- Message, chat or call content.
Read-only. It cannot write to your tenant.
- What it allows, and what Presify uses
- Microsoft grants read access to every user’s directory profile. Presify requests only name, sign-in name, work email, account type and status, license assignment, department and work location, to list your people, label the ones you monitor, exclude guests and apply the regional exclusion.
- What it never gives Presify
- Mail, files or chats. It covers directory profiles only.
Read-only. It cannot write to your tenant.
- What it allows, and what Presify uses
- Microsoft grants read access to your organization’s directory, such as users, groups and apps. Presify uses it only to read the members of groups you choose to monitor, keeping group-based enrollment in sync, and your organization’s name and verified domains.
- What it never gives Presify
- Any way to add, change or remove people or groups in your directory.
Read-only. It cannot write to your tenant.
- What it allows, and what Presify uses
- Microsoft grants read access to all of each user’s Outlook mailbox settings, including automatic replies, language and date format. Presify requests only two of them, time zone and working hours, so timelines render in each person’s local time and the business-hours overlay is correct.
- What it never gives Presify
- Email, calendar events or any other mailbox item.
Read-only. It cannot write to your tenant.
- What it does
- Lets each authorized person sign in to Presify with their own Microsoft account.
- What it never gives Presify
- Access to anyone else’s data.
The standard Microsoft sign-in permission.
Controls
Six controls, in plain words.
What Presify can reach, how your data is kept apart, and who can see what happened.
- Microsoft GraphRead-only consent, approved once by a Microsoft 365 admin.
- PresifyCollects only for the people you enroll, and keeps each workspace apart.
- YouAuthorized people sign in with their own Microsoft account.
Read-only, narrowly used
Presify reads Microsoft Teams presence, the user and group directory information it needs to label and scope users, and each person’s time zone and working hours. Microsoft’s permissions reach further, so Presify’s own code limits what it asks for and keeps. It never reads email, chats, calls, files, or calendar events.
Tenant isolation
Every record is tied to your Microsoft tenant in code, and the database enforces it again with row-level security. Then more than 900 isolation tests check that wall on every code change.
Encryption
Encrypted in transit and at rest, with customer-managed keys that rotate every year. Microsoft access tokens are encrypted too, and never written to logs.
Access control
Microsoft Graph access is granted by a one-time admin consent to four read-only permissions, each one in use, and Presify asks Microsoft for only the fields it needs wherever Microsoft allows it. Internal access is least-privilege and MFA-enforced.
Audit logging
Every action that changes something is logged with who did it, what they did and what it touched, admin actions included. Entries are hash-chained, so tampering shows, and the log is archived to locked storage for seven years.
Microsoft-native, no agents
Presify runs on Microsoft Graph with admin consent. No endpoint agents, nothing inside your network. People sign in through your own Entra tenant, so your Conditional Access and MFA policies apply, and you can switch Presify off in Entra any time.
Privacy
Privacy is part of the design.
The same discipline that protects your data also limits what we collect in the first place.
Data minimization
Presify keeps Teams presence, basic directory information, and each person’s time zone and working hours, nothing else. Microsoft’s permissions reach further than that, so Presify’s own code asks for only the fields it uses where Microsoft allows it and drops anything else Microsoft sends before it is stored. Every permission and its purpose is listed publicly in the documentation.
Retention you control
History is bounded by your plan and trimmed automatically. Per-user and workspace-wide deletion are built in, with legal hold for the records you must keep.
An audit trail you can read
Every administrative action lands in an append-only audit log you can review and export on Pro and Scale, including anything our support staff does in your workspace.
Honest by design
Every flag shows how it’s calculated, reports say plainly that presence isn’t productivity and a flag isn’t proof, and the browser Global Privacy Control signal is honored on this site.
History is bounded by plan
- Basic7 days
- Standard30 days
- Pro 50, 100, 250180 days
- Scale360 days
Past the window, history is trimmed automatically. You can delete one person’s history, or the whole workspace, at any time.
Operations
Resilience and transparency.
The operational controls a security review asks about.
Data residency
Your workspace data is stored and processed in US-based AWS regions. People whose Microsoft 365 directory location is set to the EEA, UK, Switzerland, or Canada are excluded from monitoring automatically.
Incident & breach response
Written incident-response and breach-notification runbooks, rehearsed in a tabletop exercise in September 2026. If a breach ever affects your data, you hear from us within 72 hours.
Sub-processor transparency
Every sub-processor is named with its purpose and location, published in the Privacy Policy and kept current as the list changes.
Backups & recovery
Encrypted, automated backups with 14-day point-in-time recovery. We time our restore drills, and the last two each took under 20 minutes.
Penetration testing
Multiple iterative rounds of penetration testing in July 2026. We fixed every confirmed finding, the final round came back clean, and we test again at least once a year.
Secure development
Every code change gets static analysis, secret scanning, a dependency audit and the cross-tenant test suite. Vulnerabilities are fixed against set deadlines, critical ones within 7 days.
SOC 2
Where we are on SOC 2
Our controls are mapped to the SOC 2 Security and Availability criteria and backed by written policies, a yearly penetration test and timed restore drills. The security packet walks through them. There is no formal audit yet. Need evidence for a specific criterion? Ask.
- Controls mapped to SOC 2 criteriaIn place
- Written security policy setIn place
- Penetration testJuly 2026
- Security packetOn request
- Formal SOC 2 auditNot yet
Running a procurement or insurance review?
Every control a reviewer asks about, with dates and evidence, on one printable page. Short version up top, details below.
Request the security packetFor IT and security
Security review shortcut
If your IT or security team is reviewing Presify, these are the fastest places to check scope, permissions, data handling, and uptime posture.
Microsoft permissions
Every Graph permission Presify requests, what it is used for, and what it cannot access.
Read the docsData-access FAQ
Plain answers about emails, chats, files, calendars, monitored users, and setup.
Read the FAQData Processing Agreement
The contractual data-processing terms and sub-processor disclosures.
Read the DPAService status
Current operational status for presence collection, sign-in, reports, and email.
See statusSee the pattern behind the green dot.
One read-only Microsoft sign-in, about five minutes, and presence history starts building from that moment. Nothing to install on anyone’s laptop.
Payments are processed by Stripe. Cancel anytime; access continues to the end of the paid period.