Security & trust
Everything a security review wants to know about Romy, on one page. What is still open is stated too.
Hosting and processing
Hosted in Microsoft Azure, region Germany West Central (Frankfurt). Processing stays within the EU Data Boundary. These are two statements: where the servers are, and the area in which data is processed.
Romy keeps no copy of your data. Romy fetches, prepares and returns. What is stored permanently is the log of what was queried and what was executed.
Reading and acting are separate
Romy Diagnostics reads. Romy Engage may act, and only after a person confirms. Both are separate applications in your Entra ID, consented to and revoked separately.
An allow list names the permitted calls one by one. A second deny list rules out the dangerous neighbouring actions: reset, retire, passcode reset. A confirmation is valid for 15 minutes and can be redeemed exactly once.
Log
Every call to Microsoft Graph leaves a row with time, purpose and result, without content. Every executed action is logged with trigger and confirmation and can be exported as evidence.
Operations logs contain no names, no device IDs and no content.
Revocation
You revoke Romy's access yourself at any time: Microsoft Entra admin center, Enterprise applications, the Romy app, Delete. From then on Romy can no longer read or execute anything.
Certifications
Romy holds no certification such as ISO 27001 or SOC 2 today. We name a certification once we have it. We send the data processing agreement under Art. 28 GDPR on request.
Which permissions Romy requests per app
The same permissions Microsoft shows in the dialog, with what Romy does with them.
Romy Diagnostics
- DeviceManagementManagedDevices.Read.AllManaged devices: Model, OS, compliance, encryption, free storage, last sync, enrollment date
- Device.Read.AllDevice objects in Entra ID: Join type and last sign-in, surfaces devices that aren't managed at all
- DeviceManagementConfiguration.Read.AllPolicies: Your configuration and compliance policies, and which devices meet them
- DeviceManagementApps.Read.AllApplication inventory: Detected apps per device and the catalog you deploy in Intune
- DeviceManagementServiceConfig.Read.AllIntune baseline settings: The configuration we measure your readings against
- User.Read.AllUser accounts: Name, department, title, license assignment, whether the account is active
- Group.Read.AllGroups: Security and Microsoft 365 groups, including owners
- GroupMember.Read.AllMemberships: Who is in which group
- Directory.Read.AllDirectory (read): The base access that resolving relationships between objects requires
- RoleManagement.Read.DirectoryAdmin roles: Who holds which privileged role in the directory
- AuditLog.Read.AllAuthentication methods (registration report): Which methods are registered, never the secrets themselves, never a password
- Policy.Read.AllConditional Access: Your policies, and whether they're enforced or only reporting
- AuditLog.Read.AllDirectory and sign-in logs: What changed, by whom, and when someone last signed in
- Organization.Read.AllOrganization and licenses: Verified domains and booked license packages: paid vs. assigned seats
- Reports.Read.AllUsage reports: Microsoft 365 usage per service, proves a downgrade instead of guessing at one
Romy Engage
- DeviceManagementManagedDevices.PrivilegedOperations.AllDevice actions. Romy uses the restart and nothing else.
- DeviceManagementManagedDevices.Read.AllFind the target device before Romy suggests an action.
Romy in Teams
- AppCatalog.ReadWrite.AllUpload the Romy app to your Teams catalog once, or update an older version. No other app, no deletion.
- TeamsAppInstallation.ReadWriteForUserInstall the Romy app for you, the signed-in person. Nobody else.
What Romy never requests
None of the three apps requests these permissions. You can check it in your own Entra ID under Enterprise applications.
- Application.ReadWrite.All
- AppRoleAssignment.ReadWrite.All
- RoleManagement.ReadWrite.Directory
- Directory.ReadWrite.All
- User.DeleteRestore.All
- DeviceManagementManagedDevices.ReadWrite.All
- GroupMember.ReadWrite.All
- User.ReadWrite.All
Subprocessors
Services Romy operates on your behalf. Microsoft Graph, Entra ID and Intune belong to your own Microsoft contract; there you are the controller.
| Service | Provider | Location | Status |
|---|---|---|---|
| Azure Container Apps, Table Storage, Key Vault, Log Analytics | Microsoft Ireland Operations Ltd. | Germany West Central (Frankfurt) | approved |
| Azure Virtual Machine (Romy app test bench) | Microsoft Ireland Operations Ltd. | Germany West Central (Frankfurt) | approved |
| Bot Framework (delivery of Teams messages) | Microsoft Ireland Operations Ltd. | global | move to the European region in preparation |
| Azure OpenAI | Microsoft Ireland Operations Ltd. | EU | not in production use |
| Grafana Cloud (operations counts without customer data) | Raintank Inc. (Grafana Labs) | location not evidenced | counts only, no identifiers |
| GitHub Enterprise Cloud (source code, no customer data) | GitHub B.V. | EU data residency | approved |
Report a vulnerability
Write to info@getromy.com. We confirm receipt within two working days. The details are also in /.well-known/security.txt.