Collector privacy policy
This policy covers the "SYAGA Audit" browser extension, published by SYAGA CONSULTING. It supplements the service privacy policy and states precisely what the extension reads, what it sends, and what it never does.
The extension transmits no personal data in the clear. Identifiers (names, e-mail addresses, domain names) are replaced by tokens on your own machine, before anything is sent. You do not have to take our word for it: verification is described below.
What the extension reads
The extension reads the CONFIGURATION of your Microsoft 365 subscription through Microsoft's own administration interfaces, using the permissions you explicitly grant at install time. Every one of those permissions is read-only.
- Security and compliance settings: access policies, sharing settings, mail rules, logging.
- Structural facts needed for assessment: number of accounts, presence or absence of a setting, assigned administrative roles.
- Licence status and which services are enabled on the subscription.
The extension never reads the content of your messages, files, conversations or calendars.
Why each permission is requested
The extension requests four technical permissions from the browser. Each serves a single purpose, verifiable in the published source code.
| Permission | Purpose, and nothing else |
|---|---|
identity | Obtain the redirect address used by Microsoft sign-in. No identity is read or stored through it. |
storage | Keep your pseudonymisation key and scan progress on your machine, and only there. Nothing is synchronised. |
tabs | Open the Microsoft sign-in window, then close it once authentication completes. |
webRequest | Detect the return of the Microsoft sign-in for administration interfaces that offer no other means. The extension only observes redirect addresses it triggered itself. |
The extension reads no other page, injects no code into the sites you visit, and runs only when you start an audit.
What leaves your machine
A single network exit point exists in the code. It sends the audit result to our servers, after local pseudonymisation.
- Names, e-mail addresses and domain names are replaced by tokens computed on your machine with a key that never leaves it.
- A detector blocks the transmission if any clear-text data escaped pseudonymisation. When in doubt, sending fails rather than proceeds.
- No data is sold, rented, or passed to any third party for commercial or advertising purposes.
- No advertising tracker, no analytics, no profiling.
How to verify this yourself
None of these claims rests on a screen we control.
- Microsoft's own consent screen lists the requested permissions: all are read-only. Microsoft guarantees that an application granted these permissions cannot modify anything.
- Your own Microsoft audit logs record every read performed. You can revoke our access at any time, in one click, from your administration console, without going through us.
- The code is published, readable and unminified. Checksums of the shipped files are published and recomputable. Your browser's Network tab shows you, on your machine, what actually leaves it.
Retention period
The pseudonymised result is kept for as long as it takes to produce your report and let you download it. You can trigger its permanent deletion from your report page. The pseudonymisation key stays on your machine and disappears when you uninstall the extension.
Changes to this policy
Any change to this policy is published on this page. A change that would broaden the nature of the data read would require a fresh permission request, presented by the browser.
Contact us
For any question about this policy or about exercising your rights: dpo@syaga.eu
SYAGA CONSULTING, publisher of the SYAGA Audit collector.