# Privacy Policy | TenuVault How TenuVault handles personal data: cookieless website analytics, a desktop app that keeps tenant data on your computer, license checks, purchases through Polar, the web portal and your rights under the GDPR. Canonical: https://www.tenuvault.com/privacy **Legal**How we handle your data # Privacy Policy Last updated: 13 November 2026 This Privacy Policy explains how TenuVault ("we", "our", or "the Service") handles personal data when you visit tenuvault.com, use the TenuVault Desktop app, buy a subscription or use the TenuVault web portal. We designed the Service to minimize data collection and focus on privacy by default: the desktop app works with your Intune tenant from your own computer, and your tenant data and Microsoft access tokens never reach our servers, except for feedback you choose to send from the app. ## Data controller The controller responsible for data processing in connection with the Service is: Ugurlabs UG (haftungsbeschränkt) Fährstraße 217 40221 Düsseldorf Germany Managing Director: Ugur Koc Email: [support@tenuvault.com](mailto:support@tenuvault.com) ## Desktop app and web portal TenuVault comes as a desktop app and as an older web portal. They handle your data differently. They share only the hosting of this website: the desktop app calls only the license service, on Pro and MSP the CIS Benchmarks content service, the feedback service when you send feedback and the setup diagnostics service if you agree to share setup diagnostics, never the web portal's server functions, and none of these services accesses web portal data. ### TenuVault Desktop - Runs on the admin's computer and signs in to Microsoft directly, as a public client without a secret. - Intune configuration and backups stay on the computer or in your own Azure storage account. They are never sent to us. A screenshot you choose to attach to feedback can show parts of them. - Microsoft access tokens never leave the computer. - Requests to tenuvault.com are license checks, with the license key or a Microsoft ID token (verified, never stored), the tenant ID and a random installation ID, and on Pro and MSP downloads of CIS Benchmarks content, authenticated with the signed license entitlement, feedback you choose to send and setup diagnostics if you agree to share them. - We store license activation records, a log of CIS Benchmarks content downloads, feedback you send and setup diagnostics you agree to share, never backups. Tenant configuration reaches us only as far as you include it in feedback, for example in a screenshot. ### TenuVault web portal - Runs in your browser and in server functions on tenuvault.com, hosted by Vercel. - Each request carries your app registration's tenant ID, client ID and client secret. Our servers use them to call Microsoft Graph and Azure for you. - Policy content passes through our servers while a request runs. It is not stored there. - Backups, the audit log and tenant metadata are stored in your own Azure Storage and Automation accounts. - Server logs can contain tenant IDs, backup paths and policy names, but not the client secret. ## Website and analytics We use privacy friendly analytics (Plausible) on tenuvault.com to understand aggregate website usage without cookies or personal identifiers. - Plausible Analytics is cookieless and does not track personal data or use browser fingerprinting. - Plausible collects aggregated metrics such as page views, referrers, and device types. - We do not use cookies for analytics or tracking. The website is hosted on Vercel. When you visit it, our hosting provider processes request data such as your IP address, the requested page, the time of the request and your browser's user agent in order to deliver the site and keep it secure. ## Desktop app TenuVault Desktop for Windows and macOS backs up, compares and restores your Intune configuration on your own computer. It signs in with an Entra app registration in your own tenant and calls Microsoft Graph and Azure directly from your machine. There is no TenuVault proxy or relay in between. - Your backups, Microsoft access and refresh tokens and your backup recovery key never reach our infrastructure. Your tenant configuration does not either, except what you include in feedback you choose to send, for example in a screenshot. - Backups stored on your computer or a network share are encrypted with AES-256-GCM. Backups stored in your own Azure Storage account are not encrypted by TenuVault: they are protected by Azure encryption at rest, and anyone with data access to the account can read them, through Azure role assignments, shared access signatures or, if Shared Key access is enabled, account keys. We cannot access either. - The app contains no analytics or crash reporting. It sends feedback only when you choose to send it, and setup diagnostics only if you agree to share them, as described under [Setup diagnostics](#setup-diagnostics). - **On your device:** the app keeps its token cache, tenant profiles, backup encryption keys, license key and license activations in an encrypted store protected by the operating system (DPAPI on Windows, Keychain on macOS). The only TenuVault server the app contacts is tenuvault.com, for the license checks, CIS Benchmarks downloads, feedback and setup diagnostics described in the next sections. ## License checks ### Pro trial without email When the Pro trial starts in the app, we store keyed hashes of the tenant ID and installation ID, the trial dates, app version, how the trial started and the time of the last license check. We use these records for one trial per tenant and the per-install limit, based on our legitimate interest in preventing repeated trials (Article 6(1)(f) GDPR). Only if you choose to send an email address do we store it separately for setup tips and trial reminders, based on your consent (Article 6(1)(a) GDPR). You can remove the address in the app or by unsubscribing. Records are deleted 24 months after the trial ended. To check your plan, the app contacts our licensing service at tenuvault.com the first time you use a tenant, every six hours while it runs, and when you enter a key, change license sharing, remove a tenant or deactivate the machine. Depending on the request, the licensing service receives: - your license key, or no key on Community and when your organization shares its license with your tenant; - a random installation ID generated by the app, which identifies the installation and not you or your device hardware; - the Microsoft Entra tenant ID being licensed; - the client ID of the Entra app registration you signed in with, so a license shared with your tenant is limited to that app registration; - a short lived Microsoft sign-in token (ID token) as proof of the tenant and app registration you signed in to. It contains identity claims such as your name and user principal name. We verify it with Microsoft's public signing keys and use only its tenant ID and the ID of the app registration it was issued to. The token is not stored; - your operating system and the app version; - for refresh and release requests, the ID of the activation and, for an organization license, the ID of the license; - your IP address, which is processed at the request level by our hosting provider and used transiently to limit request rates. **What we store:** each activation (installation ID, tenant ID, operating system and app version) is recorded with your license key in Polar, our merchant of record. When a key holder shares a license with their tenant, we store the tenant ID, the client ID of the app registration they signed in with, the Polar IDs of the license key, its plan and the sharing activation (never the key itself) and the time of the last change in our own database. For each activation we also store its Polar activation ID, the time of its last successful license check and, if it is released or deactivated, when that happened, in our own database, without your license key, tenant ID or installation ID. Apart from these records, the trial records described above and the result totals described below, we do not store other license check data ourselves. Request logs are kept by our hosting provider as described under Data retention. **Purpose:** we use this data to validate your license, to enforce the tenant limits of your plan and the limit of 5 installations per tenant, and to let other administrators who sign in to a tenant through the shared app registration use a license that its key holder shares with the tenant. The time of the last license check lets us free the slot of an installation that has not checked its license for 30 days, when a new installation of the same tenant would otherwise exceed the limit. The released installation activates again the next time it is used, if its tenant has a free slot. For keys and trials, we also use the time of the last license check to see whether TenuVault is still in use on a license or trial, for example to offer help when a trial stops checking in. From the request logs of our licensing service, we also count tenant license requests and trial starts by result, in daily and weekly totals without tenant IDs, installation IDs or IP addresses, to see whether tenant license checks and trial starts that reach our licensing service work after sign-in and where they fail. We keep these totals for 24 months after the day counted. The service answers with a signed entitlement that lets the app keep working offline for up to 14 days. ## CIS Benchmarks downloads On Pro and MSP, the app downloads the CIS Benchmarks catalog and the content of each benchmark Level you assess from tenuvault.com. Each download is authenticated with the signed entitlement from the last license check, which contains your license key ID, the activation ID, the tenant ID, the installation ID and your plan. The request contains no tenant configuration, no assessment results and no Microsoft tokens. **What we log:** for every download, the server writes one log entry with the tenant ID, the installation ID, the license key ID and the time, and for benchmark content also the benchmark, version and Level. Your IP address is processed at the request level by our hosting provider. **Purpose:** we use this data to confirm that the license includes CIS Benchmarks, to deliver the content and to keep a record of which licenses received CIS content, which protects content we license from the Center for Internet Security. The content itself is stored in a private storage bucket of our own and is never public. ## Feedback from the app The app's Share feedback dialog sends your feedback to tenuvault.com only when you select Send feedback. The dialog lists everything that is sent before you do. We receive: - your answers to what you were trying to do and what got in your way, which can contain anything you type; - a reply-to email address, if you enter one; - the app version, your operating system and its version, your plan, the name of the app page you were on and a random message ID that keeps a retry from being counted twice; - only if you tick it, a screenshot of the app window. It shows what was on screen, which can include tenant, policy, group or user names; - your IP address, which is processed at the request level by our hosting provider. A keyed hash of it is stored with the feedback to limit how often feedback can be sent. The app does not add your installation ID, tenant ID, license key or Microsoft tokens to feedback. **What we store:** the feedback, its details and the screenshot are stored in our Supabase database and private storage. A copy is emailed to our support mailbox through Resend, with the screenshot attached and your reply-to address as Reply-To. **Purpose:** we use feedback to understand problems with the app, to improve it and to answer you if you gave a reply-to address. ## Setup diagnostics A new installation of the app asks whether you want to share setup diagnostics with us. They show us where setup stops in real environments, for example when Conditional Access or consent settings block a step, so we can fix it. Nothing is shared until you agree. - **When you are asked:** on the welcome screen, with two equal choices, Share setup diagnostics and Don't share. If you do not answer there, the app may ask next to a setup error, at most once each time the app runs. After you answer it never asks again. You can change your choice at any time in Settings > About. - **Before you agree:** the app stores only whether you answered the question. It creates no random ID, keeps no events and sends nothing. - **Who is asked:** only installations first started on the app version that introduced setup diagnostics. Installations from before that version are never asked and send nothing. - **Policy:** your organization can turn setup diagnostics off with the DisableSetupDiagnostics policy. The question is then not shown and the setting stays off. ### What is sent Each request carries a random ID that the app creates when you agree, the app version, the operating system (Windows, macOS or Linux), the release channel (stable or nightly) and up to 50 events. Each event has a sequence number, its name, the time on your computer when it happened and, for some events, the details below. Every detail is a value from a fixed list or a short error code. The app sends no free text. - `consent`: that you agreed, and where: on the welcome screen, next to a setup error or in Settings. - `first_launch`: the operating system version (major and minor number only), the processor type (x64, arm64, ia32 or other) and whether your organization installed the app (MSI or policy). - `welcome_continue`: that you selected Connect your tenant. - `setup_route`: the setup route you chose: automatic, script, manual or handing setup to another admin. - `setup_signin`: how the setup sign-in with Microsoft Graph Command Line Tools ended (ok, failed, cancelled or timed out) and its error code, if any. - `registration`: how creating the app registration ended (created, reused, failed, not ready, consent missing or cancelled), the step it stopped at and its error code, if any. - `script_saved`: that you saved the setup script. - `signin`: how the first sign-in to your tenant ended (ok, failed, cancelled or timed out), its error code, if any, and whether the app showed you an explanation for it. - `license`: a license result for a tenant (trial started, Community, licensed, refused or license service not reachable) and the reason code of a refusal, if any. - `storage`: the backup storage you chose: on the computer, a network share or Azure. - `tenant_added`: that the first tenant was saved. - `first_backup`: how a backup ended (ok, partly or failed), until the first one that works, and the kind of error: network, permission, throttling, storage, cancelled or other. - `active_day`: that you opened the app on a later day, as the number of days since you agreed (1 to 30). An error code is a Microsoft sign-in code such as AADSTS53003, an HTTP status such as HTTP\_403 or a short word for the kind of error, such as timeout or user\_cancelled. The app sends any other error as other. `consent`, `first_launch`, `welcome_continue`, `script_saved` and `tenant_added` are sent once. The other events are sent for each attempt, so a step that fails and then works shows both: `setup_signin`, `registration` and `signin` up to 10 times each, `setup_route` up to 10 times, `license` up to 10 times, `storage` up to 5 times, and `first_backup` for each backup until the first one that works, at most 5 times. `active_day` is sent once a day. ### What is never sent No tenant IDs or names, user names, UPNs or email addresses, client IDs, license keys or the license installation ID, error message text, policy names, configuration or backup content. The random ID is not the license installation ID and is never sent with a license check. We do not link it to tenants, trials or licenses. ### Storage and retention - **After 30 days:** 30 days after you agreed, the app deletes the random ID and any events not yet sent on your computer and sends nothing more. The events already sent stay on our servers until 180 days after we received them. - **When you turn it off:** when you turn sharing off in Settings > About, or your organization sets the policy, the app deletes the random ID and any events not yet sent on your computer and asks our server to delete the events already sent. That request carries only the random ID. If the computer is offline, the app keeps only that request and retries it until our server confirms the deletion. Our server then keeps only the random ID, as a marker for 180 days, so that an upload that arrives late for it is discarded. - **On our servers:** the events are stored in our Supabase database in the EU and deleted 180 days after we received them. - **Your IP address** is processed by our hosting provider to deliver the request. Our server keeps it only in memory, to limit how often requests can be sent. It is not stored with the events, and neither is the user agent. **Purpose:** we count, per week of first launch, how many installations reach each setup step, which errors stop them and whether they recover, to fix the setup steps that fail. **Legal basis:** your consent (Art. 6(1)(a) GDPR and, for storing the random ID on your device, section 25(1) TDDDG). You can withdraw it at any time in Settings > About. During the 30 days, the app then stops sending, deletes the random ID on your computer and asks our server to delete the events already sent, as described above. After the 30 days, the app has already deleted the random ID and sends nothing more, so the events already sent can no longer be linked to your installation, by you or by us. They are deleted 180 days after we received them. Withdrawal does not affect the lawfulness of what was processed before. ## Updates and baselines The app downloads updates and OpenIntuneBaseline content directly from GitHub: - **Update checks:** unless you turn off automatic updates in the app's settings or by policy, the app reads the public release feed of the TenuVault Desktop repository 15 seconds after it starts and every six hours, and downloads installer files from GitHub. - **OpenIntuneBaseline:** when you load a pack in Quick Start or Framework coverage, the app downloads public policy files from the OpenIntuneBaseline repository. These requests contain no tenant data and no tokens. GitHub receives standard request data such as your IP address and processes it under its own privacy policy. ## Purchases through Polar Polar Software Inc. acts as merchant of record for TenuVault subscriptions. Polar processes payments, invoices, taxes, and license keys, and receives your billing details directly when you purchase, under its own privacy policy. You manage your subscription, invoices and installations in the [Polar customer portal](https://polar.sh/ugurlabs/portal). ## Free trial When the website offers a download link and setup guide by email, we store the address, request source and dates to deliver that one email and limit repeated requests. No Polar customer, subscription, license key or getting-started series is created for this request. The record is deleted 24 months after the last request. Older app versions may instead receive an email asking them to update to start Pro automatically. When you request an email trial key on our website or in a desktop app version that offers it, you give us your email address. We use it to create a free trial subscription and license key in Polar, our merchant of record, and to email you the key through Resend. A second request for the same address sends the existing key again instead of a new trial. - We store the address, where the request came from (for example the pricing page or the License page), the Polar IDs of the trial and when you asked, in our Supabase database. We use this record to deliver the key, to give each address one trial, and to answer you about your trial. We do not add it to a newsletter. - The trial key also starts the getting-started emails described below, which you can unsubscribe from. - Unless you have bought a plan, we email you 5 days and 1 day before the trial ends, and once 1 to 7 days after it ended. Each of these emails has a link that stops them; your trial is not affected. - The record is deleted 24 months after your last trial request, or earlier if you ask us to delete it. ## Getting-started emails When you get a TenuVault license, we send up to four short emails in the first weeks that help you set up backups and show drift detection, baselines and restore. They come from support@tenuvault.com, so you can reply with questions. - We use the email address of your Polar customer account, your plan and whether your license key has been activated for a tenant, which Polar records when you sign in. We do not use your name or any usage data from the desktop app. - The emails are sent through Resend. Each one has an unsubscribe link, which stops the remaining getting-started emails. License and billing emails from Polar are not affected. - We keep a record of which emails were sent in our Supabase database. Your email address is deleted from it 30 days after the series ends or you unsubscribe. ## Web portal The TenuVault web portal at tenuvault.com/portal remains available for existing users. Unlike the desktop app, it is a hosted web application: its interface and server functions run on our hosting provider Vercel, while your backups, audit log, tenant metadata and backup jobs are kept in your own Azure subscription (your Azure Storage account and Azure Automation account). - To connect a tenant, you enter the tenant ID, application (client) ID and client secret of an app registration in your own tenant, and the names of your Azure resources. The portal keeps them in your browser's session storage. The deployment template generated during onboarding contains the client secret; it is held only in the open page and is not saved in your browser. - When you use the portal, your browser sends these details with each request to our server functions. They use them to obtain a token from Microsoft for your app registration and to call Microsoft Graph, Azure Resource Manager, your Azure Storage account and Azure Automation. Intune configuration and backup content pass through these functions while a request is processed, for example when you restore, compare or download a backup. - We do not store your client secret, tokens or tenant data in a database of our own. Audit entries are written to the audit log container in your own storage account. - Our hosting provider's runtime logs may contain operational details such as tenant IDs, backup file paths, policy names and error messages returned by Azure. They do not contain your client secret. ## Contacting us When you email us, for example for support or a security report, we process your email address, your message and any details you include in order to answer you. Do not send access tokens, client secrets, passwords or unredacted tenant exports by email. ## Nonprofit applications When you apply for free Pro, we process your organization’s name, country, optional website, registration number or recognition link, your name and email address, your authorization confirmation, and any explanation you provide. We use these details to verify eligibility, prevent duplicate or abusive requests, and answer your application. The website sends the application through Resend to our support mailbox. Your email address is used as Reply-To so we can respond. Applications are handled as support correspondence; they are not stored in a separate application database or used for marketing. We may request additional recognition evidence by email. Do not submit tokens, passwords, personal identification documents, or tenant exports. Our service uses transient, hashed request-address counters to limit attempts. Email content is processed by Resend and retained in support correspondence as described under data retention below. Submitting an application does not automatically create or activate a license. ## Quote requests When you request a quote, we process the company name and address, the VAT ID if you enter one, your name and email address, your reference if you enter one, and the plan and number of tenants. We use these details to create the quote, send it to you, answer questions about it and, if you order, prepare the contract and the invoice. The quote is created on our server, stored in our database and sent through Resend to the email address you entered and to our support mailbox. A VAT ID is checked for its format only at this point. To limit attempts, a keyed hash of the request address is stored with the quote request and deleted within 24 hours. We count each quote in our aggregated website statistics with the plan and the country, without your details. Quote requests are not used for marketing. ## Service providers - **Resend** delivers nonprofit application emails to our support mailbox, feedback from the app to our support mailbox, free trial keys to the address you entered, quotes to the address you entered and to our support mailbox, and the getting-started emails to license holders, and processes their content and email metadata. See [Resend’s privacy policy](https://resend.com/legal/privacy-policy). - **Polar Software Inc.** is the merchant of record for purchases and stores license keys and activations, including the customer account and trial subscription created for a free trial. - **Vercel Inc.** hosts the website, the licensing service, CIS Benchmarks delivery, the feedback service, the setup diagnostics service and the web portal, processes request data such as IP addresses and keeps the server logs on our behalf. - **Supabase Inc.** hosts the database that holds licenses shared with a tenant, the record of free trial requests, quote requests, the record of getting-started emails, feedback from the app and setup diagnostics, and the private storage for CIS Benchmarks content and feedback screenshots. The database is located in the EU (AWS region eu-west-1, Ireland). - **Plausible Analytics** provides cookieless, aggregated website statistics. - **GitHub** delivers app updates and OpenIntuneBaseline content that the app downloads directly. We do not sell your personal data or share it with third parties for their own marketing. A data processing agreement is available on request. ## Legal bases - **Consent (Art. 6(1)(a) GDPR and section 25(1) TDDDG):** setup diagnostics from the desktop app, only if you agree to share them. You can withdraw consent at any time in the app under Settings > About; within the 30 days this also deletes the events already sent. - **Performance of a contract (Art. 6(1)(b) GDPR):** license checks, CIS Benchmarks downloads, organization licenses, purchases, issuing and delivering a free trial key you asked for, creating a quote you asked for, the web portal and answering your requests. - **Legitimate interests (Art. 6(1)(f) GDPR):** hosting and securing the website and services, request rate limiting, keeping a record of free trial requests so each address gets one trial, logging CIS Benchmarks downloads to protect licensed content, aggregated website statistics without personal identifiers, aggregated statistics on tenant license request results, without identifiers, update delivery, getting-started emails about the product you licensed, which you can unsubscribe from at any time, and reading and answering feedback you choose to send from the app. - **Legal obligations (Art. 6(1)(c) GDPR):** where we must keep records, for example under tax law. ## Data retention - Activations are stored with your license key in Polar for the lifetime of your subscription. You can remove an activation at any time by removing the tenant or deactivating the machine in the app, or in the Polar customer portal. An activation that has not checked its license for 30 days may be released when a new installation of its tenant needs the slot. - The record of an activation's last license check is deleted 12 months after its last check, but no earlier than 30 days after the activation was released or deactivated, so that a license check still in progress at that moment is refused. - A license shared with a tenant is stored until sharing is turned off or the license ends. - Your email address in the getting-started email record is deleted 30 days after the series ends or you unsubscribe. Which emails were sent is kept without it. - The record of a free trial request, including your email address, is deleted 24 months after your last trial request, or earlier if you ask us to delete it. - Microsoft ID tokens are not stored. IP addresses used for rate limiting are kept only in the memory of the server handling the request, except the keyed hash stored with feedback and with a quote request, which is deleted after 24 hours. - Feedback from the app and its screenshots are deleted 12 months after they were sent, or earlier if you ask us to delete them. The email copy is kept as support correspondence. - Setup diagnostics are deleted 180 days after we received them. On your device, the random ID and unsent events are deleted 30 days after you agreed. When you withdraw consent, the app deletes them at once and asks our server to delete the events already sent. Our server keeps the random ID of a deleted set as a marker for 180 days, so that late uploads are discarded. - A quote request is deleted 12 months after it was created, or earlier if you ask us to delete it. A quote that leads to an order is kept as business correspondence for the statutory period of six years. The email copy is kept as support correspondence. - Request logs, including the log entries of CIS Benchmarks downloads, are retained within our hosting provider's systems according to its log retention. - Totals of tenant license request and trial start results are kept for 24 months after the day counted. - Billing records are kept by Polar under its own privacy policy and applicable retention obligations. - We do not retain your backups, or your Intune configuration data except what you include in feedback, which is kept as described above. ## International transfers Some of our service providers are based in the United States and may process data outside the European Economic Area. Where this happens, it is protected by appropriate safeguards such as the EU Standard Contractual Clauses. ## Your rights Under the GDPR you have the following rights regarding your personal data: - **Right to access:** request a copy of the personal data we process about you. - **Right to rectification:** request correction of inaccurate personal data. - **Right to deletion:** request that we delete your personal data. - **Right to restriction:** request that we restrict the processing of your personal data. - **Right to data portability:** receive the data you provided to us in a structured, machine readable format. - **Right to object:** object to processing based on our legitimate interests. If you are located in California, you may also have rights under the CCPA. We do not sell or share personal information. To exercise your rights, contact us at the email below. ## Supervisory authority You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, your place of work or the place of the alleged infringement (Art. 77 GDPR). The supervisory authority responsible for us is the [Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)](https://www.ldi.nrw.de), Düsseldorf. ## Children's privacy The Service is intended for professional and enterprise use and is not directed to children. ## Changes We may update this policy to reflect improvements or operational changes. If we make material changes, we will update the date above. ## Contact Questions about this policy or requests about your data? Contact us at [support@tenuvault.com](mailto:support@tenuvault.com). Report security issues to [security@ugurlabs.com](mailto:security@ugurlabs.com). The [Trust Center](https://www.tenuvault.com/trust) lists every connection the desktop app makes. You can also reach us by post: Ugurlabs UG (haftungsbeschränkt), Fährstraße 217, 40221 Düsseldorf, Germany.