Terms of Service
These terms govern your use of TenantSentinel products and services. Please read the warranty, liability, and advice sections carefully—they define what this software does and does not promise.
Service Model
TenantSentinel Recon is available as a self-serve desktop application for Enterprise and MSP customers, or as an operator-managed assessment service. Enterprise customers install the app and run scans independently; Managed Assessment customers receive reports delivered by our team. TenantSentinel Proof is currently offered in limited early access ahead of general availability.
Acceptable Use
TenantSentinel products are licensed for legitimate security assessment, compliance preparation, and operational planning of your own Microsoft 365 tenant, or of tenants you manage on behalf of clients. Use against tenants you are not authorized to assess is prohibited.
SOC 2 and Compliance Posture
TenantSentinel aligns its internal controls with SOC 2 Type II principles as we mature toward formal certification. Our architecture is designed around the principle that customer tenant data never leaves the customer's environment, which substantially reduces the compliance scope of our licensing infrastructure. Enterprise customers requiring a Data Processing Agreement (DPA) or Business Associate Agreement (BAA) should contact us directly.
Least-Privilege Access
TenantSentinel products operate on the minimum Microsoft Graph API permissions required to function. Our assessment tools are strictly read-only and cannot modify your tenant configuration. The one exception is the one-time registration of a self-signed certificate on your Entra app registration, which is required for authentication. Future remediation features will explicitly request additional scopes and obtain administrator consent before any write operation is performed.
Availability
Service endpoints (licensing, certificate registration) may be updated as the platform matures. Changes that affect existing customers will be communicated in advance with adequate transition time.
Updates
These terms may be revised as the service evolves. Material changes will be communicated to active customers before taking effect.
No Warranty
The Service is provided on an AS IS and AS AVAILABLE basis without warranties of any kind, whether express or implied, including but not limited to implied warranties of merchantability, fitness for a particular purpose, accuracy, or non-infringement. TenantSentinel does not warrant that the Service will be uninterrupted, error-free, or produce results suitable for any specific decision or action.
Limitation of Liability
To the maximum extent permitted by law, in no event shall TenantSentinel, its affiliates, or contributors be liable for any indirect, incidental, special, consequential, or punitive damages, or for any loss of profits, revenue, data, or business opportunity, arising out of or related to use of the Service. TenantSentinel's total aggregate liability for any claim shall not exceed the fees actually paid by Customer to TenantSentinel in the twelve (12) months immediately preceding the event giving rise to the claim. For users of the free tier, this amount is zero.
Not Legal or Compliance Advice
TenantSentinel Recon maps tenant configuration to frameworks such as CIS Microsoft 365, NIST SP 800-171, SOC 2, and HIPAA for informational purposes only. Framework mappings, health scores, and remediation guidance are provided as tools to support your internal security program and do not constitute legal, regulatory, audit, or compliance advice.
TenantSentinel is not a CMMC Third-Party Assessment Organization (C3PAO) and does not perform certifications. TenantSentinel Proof produces technical evidence and analysis intended to support assessment preparation. Control mappings, coverage classifications, and scoring estimates it produces are informational; any score it reports is an estimate and is not a certified SPRS score.
Customer is solely responsible for determining whether its use of Microsoft 365 satisfies applicable laws, regulations, and contractual obligations.
Governing Law
These terms are governed by the laws of the State of New Jersey, United States, without regard to its conflict of laws principles. Any dispute arising out of or related to these terms or the Service shall be resolved in the state or federal courts located in New Jersey, and the parties consent to the exclusive jurisdiction of those courts.