Privacy Policy & Data Governance

1. Introduction & Operating Entity

This Privacy Policy explains how IT Ninjas, LLC ("Company", "we", "our", or "us"), trading as DR IT | The IT Ninjas, collects, processes, and protects information when you access the NinjaSecure 365 software-as-a-service platform at https://ninjasecure365.com and related API endpoints.

NinjaSecure 365 is designed specifically for Managed Service Providers (MSPs), Managed Security Service Providers (MSSPs), and internal enterprise IT teams to evaluate security posture and cloud license allocation across Microsoft 365 and Azure environments.

2. Architectural Principles & Data Protection by Design

Our architecture is built on the principle of minimal data exposure:

• Default Read-Only Operation: Standard assessments execute strictly via Microsoft Graph read-only scopes (e.g., Policy.Read.All, Reports.Read.All). Our backend egress guard intercepts and blocks all HTTP mutations (POST, PATCH, DELETE, PUT) during assessment passes.
• Zero Persistent Footprint: We do not deploy long-lived software agents, virtual machines, or local executables into your client environments.
• Zero Customer Data Model Training: Telemetry, assessment findings, and organizational configurations evaluated by NinjaSecure 365 are never used to train, retune, or benchmark public machine learning or artificial intelligence models.
• Pre-Transit PII Scrubbing: If an operator chooses to generate an AI-assisted executive narrative summary, all User Principal Names (UPNs), email addresses, Azure/Entra GUIDs, IPv4/IPv6 addresses, and organization names are scrubbed locally before prompt transit.
• Deterministic Opt-Out: Tenant administrators can permanently disable AI narrative features at the tenant governance policy level. When opted out, 100% of reports and summaries are generated using deterministic code rules.

3. Information We Collect

We collect and process the following categories of information:

• Account & Authentication Data: Operator email addresses, full names, organizational domain, bcrypt/argon2 password hashes (for email/password accounts), and Time-Based One-Time Password (TOTP) MFA secret enrollments.
• Tenant Technical Telemetry: Microsoft 365 configuration settings, Conditional Access policy metadata, Defender for Office 365 flags, SubscribedSKUs license counts, and anonymized user activity timestamps (e.g. inactive >90 days).
• Billing & Subscription Information: Handled securely via our payment processor (Stripe). We store customer identifiers, plan tier IDs, subscription status, and quota counters. We never store credit card numbers or bank account details.

4. Security & Storage Boundaries

All customer and assessment data is stored in private PostgreSQL databases running on Supabase with Row-Level Security (RLS) policies enforced. Storage buckets for report artifacts (PDFs, Markdown, Excel workbooks) are completely private and accessible only via authenticated session tokens or short-lived signed URLs.

Universal Two-Factor Authentication (AAL2 TOTP MFA) is mandatory for administrative access across all tenant command centers.

5. Data Retention & Deletion

Assessment snapshots are retained based on your subscribed tier (default 90-day retention for standard tiers; 365-day retention for enterprise tiers). MSP administrators may permanently purge client tenants, historical runs, and evidence workbooks at any time via the in-app client management portal.

6. Contact & Privacy Inquiries

For inquiries regarding this policy, data processing agreements, or to exercise data subject rights, please contact our data governance team: