Everything your security team needs, in one place.

These are the sub-processors LicenseMeter engages, with their processing location and the transfer mechanism that covers it. The list is rendered from the binding Data Processing Agreement, so it is always the same list you sign.

Optional source systems you connect (Adobe, Zoom, Atlassian, Salesforce, OpenAI, Anthropic) and any CSV member lists you import (ChatGPT, Claude) are data sources, not sub-processors: we read from them on your behalf and disclose no personal data to them beyond the authenticated read request. The definitive list is Annex 3 of the DPA.

A Global Administrator grants consent once, through Microsoft's standard admin-consent dialog, for application permissions that are read-only without exception. There is no service account, agent or mailbox plugin in your tenant, and you can revoke the application in Entra ID at any time, independently of us. Usage reports are consumed as counts and last-activity dates only: metadata, never content.

The Security overview lists every requested scope, what is stored, and how to delegate the consent without standing Global Administrator rights.

Access to a workspace is invite-based and role-based (owner, admin, viewer); sign-in uses OpenID Connect with PKCE and signed, httpOnly, short-lived session cookies. Data is encrypted in transit (TLS, HSTS) and at rest (AES-256), with bring-your-own connector credentials additionally encrypted at the application layer (AES-256-GCM). Tenants are logically separated with row-level security, state-changing requests are CSRF-protected and rate-limited, and a per-workspace audit log records exports and administrative actions.

The full technical and organizational measures are Annex 2 of the DPA.

Data is collected only by the read-only sync, retained only while your tenant is connected, and deleted on disconnect. Disconnecting a workspace (Settings → Danger zone) deletes all synced data immediately and irreversibly: users, findings, prices, history and the audit log. Revoking the enterprise application in your Entra ID additionally cuts our access at the source. The one exception is the billing provider, which retains invoice data for the period required by statutory tax law. See the Privacy Policy for retention detail and your data subject rights.

Our sub-processors are selected for documented security postures and are bound by data processing agreements; the major infrastructure providers above maintain SOC 2 and/or ISO 27001 certifications, whose reports we can reference in a security review. LicenseMeter itself does not yet hold its own SOC 2 / ISO 27001 attestation.

Microsoft publisher verification for the LicenseMeter app registrations is in progress. Until it completes, the consent dialog shows the apps as unverified; Microsoft displays the current verification status directly in the dialog, so your admin can always confirm it independently.

Security reviews, pentest coordination and vendor questionnaires: customer-care@ugurlabs.odoo.com.