Security & data protection
You're granting a third party access to your directory. That deserves a straight answer to three questions: what do we access, what do we store, and how is it protected?
What we access — and what we don't
SyncMyGAL uses four Microsoft Graph application permissions, approved once by your admin on the official Microsoft consent screen. This is the exact list that screen will show you — we never request anything beyond it:
- User.Read.All — to read the Global Address List (names, job titles, work emails, work phone numbers) and profile photos.
- Contacts.ReadWrite — to write and update directory contacts in each employee's personal contacts folder.
- GroupMember.Read.All — read-only, membership only: it resolves the Entra ID groups you choose when you want to restrict who gets synced, or who receives the directory.
- OrgContact.Read.All — read-only: organizational contacts (suppliers, partners), used only if you switch that option on.
The last two exist so you can narrow the sync, never to widen it. Leave the scoping rules empty and organizational contacts off, and they are simply never called.
We do not request access to email content, calendars, files, chats, or any other workload. We can't read a single message — the permissions don't allow it, and that's enforced by Microsoft, not by our promises. You can revoke access at any moment from your Entra ID portal, which cuts us off instantly.
What we store
- Your tenant ID and subscription state — required to operate the service.
- Encrypted access tokens — encrypted at rest with AES-256-GCM (authenticated encryption, unique IV per token). Even a full database dump does not expose usable credentials.
- Sync run logs — timestamps, counts, and error summaries.
Notably, we do not build a copy of your directory. GAL data is read from Graph, written to your employees' mailboxes, and discarded from memory. Your data lives in your tenant, not in our database.
How the service is protected
- TLS everywhere; HSTS enforced. No plaintext endpoints.
- Marketplace webhooks are cryptographically verified (JWT signature against Microsoft's published keys, audience and issuer checks) before any processing.
- OAuth flows carry anti-CSRF state tokens in HttpOnly, Secure cookies.
- Rate limiting and security headers (Helmet) on every public endpoint.
- Tokens are redacted from all application logs by design.
- Infrastructure hosted in the European Union.
GDPR
- We act as a processor; you remain the controller of your directory data.
- A signed Data Processing Agreement (DPA) is available on request for Business and Enterprise plans.
- Processing takes place in the EU. No transfer outside the EEA is required to deliver the service (Microsoft Graph regional processing follows your own Microsoft 365 tenant configuration).
- On termination, tenant records and encrypted tokens are deleted. Contacts already written to your employees' mailboxes belong to you and remain in your tenant (we can remove our synced contacts on request before offboarding).
- We never sell, share, or mine directory data. Our only revenue is your subscription.
Questions we welcome
If your security team has a vendor questionnaire, send it — answering those is part of the job, not an imposition. Reach us at security@syncmygal.com.