Security & governance you can take to your security team

Trust posture at a glance

Identity & access management

• ✓Single sign-on via Microsoft Entra ID. Authentication uses the Microsoft Authentication Library (MSAL) with OAuth 2.0 / OpenID Connect for Microsoft work or school accounts (Entra ID / Azure AD) and personal Microsoft accounts. Power Pals never handles your Microsoft password.
• ✓Admin-governed access for organisations. You sign in with Microsoft Entra ID, and Microsoft 365 actions use your own delegated consent, scoped to the permissions you grant. Your Microsoft 365 administrator controls which permissions can be granted, and access can be revoked at any time.
• ✓Least privilege & role-based controls. Access to systems and data is granted on a least-privilege basis through role-based permissions and controlled administrative access.
• ✓Scoped third-party connections. Microsoft Graph permissions are requested when you connect a feature, and you can disconnect or revoke them at any time from your Microsoft account.

Data protection, encryption & residency

• ✓EU hosting. The Power Pals application and core data storage are hosted in the EU, on Microsoft Azure (Sweden) and Microsoft Dataverse (Europe). Other regions and private regional deployments can be scoped for Enterprise on request.
• ✓Encryption. Data is encrypted in transit between your device, our services, and integrated systems, and encrypted at rest in storage. Personal data may remain in encrypted backups for a limited period after deletion from live systems.
• ✓Connected mailboxes. Outlook content (email, calendar, contacts, tasks) accessed via Microsoft Graph is fetched only when your request needs it. What your Pal uses is sent to the AI provider to produce the answer and becomes part of that conversation, following its retention. Calendar entries are created without attendees, so no invitations are sent.
• ✓International transfers. Core hosting is in the EU. Where AI model providers process data outside the EEA, transfers rely on safeguards such as Standard Contractual Clauses (SCCs) and, where applicable, the EU–US Data Privacy Framework.
• ✓Data subject rights & retention. We retain personal data only as long as needed and support GDPR rights (access, rectification, erasure, restriction, portability, objection). See the Privacy Policy for full detail.

AI governance & human oversight

• ✓Human-in-the-loop by default. Power Pals is designed to assist and advise. Powers that change data in connected systems ask for approval by default, built-in mail stays in drafts, and outputs support human judgement rather than replace it.
• ✓No high-effect automated decisions. By default, Power Pals does not make decisions producing legal or similarly significant effects without meaningful human involvement.
• ✓No model training on your data. Your personal data, prompts and connected Microsoft data are not used to train AI models, including foundation models.
• ✓EU AI Act posture. Power Pals Ltd acts as an AI system provider and operates Power Pals as a limited-risk, assistive AI system with transparency and human-oversight commitments.
• ✓Audit-friendly evidence. Privacy processing records source type, detected category counts, policy mode, and outcome as audit metadata - without storing raw detected PII values.

Privacy controls: PII scanning & redaction

Power Pals includes a configurable AI data privacy layer powered by Microsoft Azure AI services (Azure AI Document Intelligence and Azure AI Language PII detection). It helps teams understand sensitive-data exposure and minimise data before it reaches AI.

• ✓Privacy scanner for all users, with optional account-level forced scanning controlled by the account owner.
• ✓Two modes. Discovery (analytics-only, non-blocking) records what sensitive categories were detected; Force Redact PII (enforcement) redacts supported sensitive values before downstream AI processing and can block if redaction cannot complete.
• ✓Redaction of supported PII such as names, addresses, emails, phone numbers, bank and card numbers, national ID numbers and credentials, in files uploaded to chat (PDF, Word, text, Markdown, CSV and Excel) and in the Privacy Scanner. Results from connected services (email, CRM, API and MCP connections) are scanned too: Off, Detect or Redact, with Detect by default, set by the account owner. Typed chat messages and knowledge-base files are not scanned.
• ✓Account-level governance & analytics exports showing usage, coverage, and operational health by user, source, and mode.

These controls support data minimisation and audit evidence. They are technical controls that assist security and privacy programmes; they do not replace legal review or guarantee complete anonymisation or GDPR compliance, and automated detection can produce false positives and negatives.

Sub-processors

We use trusted providers to operate Power Pals, under contractual safeguards and on a minimum-necessary basis. We do not sell personal data.

Personal data is shared with AI model providers only as needed to generate responses, subject to no-sale and no-training restrictions. A current, named sub-processor list is available on request.

Compliance & certifications

We are transparent about what is in place today and what is on our roadmap. Documentation for your security review is available on request.

We do not claim certified GDPR redaction, guaranteed anonymisation, or 100% detection accuracy. Security is an ongoing process and controls are reviewed and improved over time.