Privacy Policy

Guardlie is operated by Carrier Grade Inc ("we", "us"). This policy explains what information Guardlie processes when managed service providers ("MSPs") use it to manage their customers' Microsoft 365 tenants, and how we protect it.

Who is responsible

For data in connected customer tenants, the MSP that connects a tenant is the controller and we act as its processor, following the MSP's instructions. For account data about MSP staff who use Guardlie, we are the controller.

Information we process

• MSP account data: name, work email address and Microsoft organization of people who sign in, plus their role in the workspace.
• Connected tenant data, read through Microsoft Graph with the permissions a tenant administrator grants: directory objects (users, groups, roles, licenses), sign-in and MFA registration status, applications, device-management and identity policies, managed devices and apps, and security alerts and risk signals.
• Activity data: an audit log of changes made through Guardlie, and technical logs needed to operate and secure the service.

We do not read email, files, chats or other user content, and we do not sell personal information or use it for advertising.

How we use it

• To show security and configuration findings, back up and restore policies, align tenants to baselines, and run automations the MSP configures.
• To operate, secure, troubleshoot and improve the service.
• If an MSP enables the Copilot assistant, the relevant tenant data for a question is sent to our AI provider to generate an answer. It isn't used to train models.

Where it is stored and how it is protected

Data is stored in Amazon Web Services in the United States (us-east-2), encrypted in transit and at rest. Access to production systems is restricted to authorized personnel. Application secrets are held in AWS Systems Manager Parameter Store, and every connection to the service passes through Cloudflare.

Retention

Tenant data is refreshed on each sync and kept while the tenant is connected. When an MSP removes a tenant, its synced data, backups and history are deleted from the active database; encrypted database backups expire after 35 days. Account data is deleted when a workspace is closed, unless we must keep it for legal reasons.

Sub-processors

• Amazon Web Services: hosting and storage
• Cloudflare: network security and DNS
• Microsoft: identity and the Microsoft Graph API
• Anthropic: AI assistant, only when Copilot is enabled

Your choices and rights

Tenant administrators can revoke Guardlie's access at any time by removing the Guardlie enterprise application from Microsoft Entra ID. Individuals whose data is processed through an MSP should contact that MSP; we will assist it with access, correction and deletion requests. You can contact us directly about your own account data.

Contact

Carrier Grade Inc, 2665 S Bayshore Dr, Suite 220, Miami, FL 33133, United States. Email [email protected].