1. The short version
The most reliable way to protect personal data is not to hold it. Tenant Excellence assesses configuration, security, compliance, licensing and adoption — work that needs metadata about how a tenant is set up, not the content people put inside it. The application is therefore designed so that the sensitive material never enters it.
Not designed to access emails, Teams chats, SharePoint or OneDrive files, attachments, or call recordings.
The assessment reads. It does not create, change or delete users, content, settings or resources.
Authentication goes through Microsoft Entra ID. Access tokens authorise a session and are not kept as a server-side record.
Tenant data retrieved for a live assessment is processed to produce the result, not retained as a standing server-side copy.
The platform can be deployed inside infrastructure you control, so the data never leaves your boundary at all.
Sign-ins, administrative changes and assessment activity are written to an append-only audit log.
2. Data protection by design and by default — Article 25
Article 25 asks for technical and organisational measures that implement the principles effectively, and for defaults that process only what each purpose requires. Four design decisions carry most of that weight here.
Scope limited at the permission layer
Access is constrained by the permissions an authorised administrator approves through Microsoft's own consent framework. The permissions shown during consent are the authoritative list; the application cannot quietly widen them afterwards. The core assessment requests read-only scopes.
Content deliberately out of scope
The assessment answers questions about configuration — is multi-factor authentication enforced, which licences are unused, is a storage account publicly reachable. None of those questions require reading a message or a document, so the permissions that would allow it are not requested.
Nothing retained that the result does not need
A finished assessment is a set of findings and evidence references, not a copy of the tenant. Data pulled to compute a result is used for that purpose and not kept as a permanent server-side record unless a feature you switch on requires it.
Separation of duties in the product itself
Platform administration and customer data are separate surfaces. An administrator can create a company, register its tenant and set what it is entitled to assess, but cannot open that company's assessment, read its evidence, or issue an auditor link. That separation is enforced by the server, not only hidden in the interface.
3. What the application is not designed to access
Tenant Excellence is not designed to access the content of emails, Teams chats, SharePoint documents, OneDrive files, attachments, audio recordings or video recordings. If a future optional feature were to require additional access, the permissions and the purpose would be disclosed before authorisation, and you would decide whether to grant them.
3.1 Optional AI insights
The optional AI insights feature is built on the same principle. It uses the customer's own Microsoft 365 intelligence through Microsoft's Work IQ API, called from the user's browser under that user's Entra ID identity, so processing stays within the customer's Microsoft 365 tenant trust boundary and inherits its existing permissions, compliance and governance controls. What is sent is a summary of the assessment reduced to counts, statuses and published control identifiers — no names, no user principal names, no email addresses, no domain names, no resource names, no evidence text. Nothing passes through NextStep Europe servers, and no third-party model provider receives the data. The feature is off unless an administrator enables it for the tenant.
4. Roles, and the agreement between us — Article 28
For your account, contract and support records, NextStep Europe determines the purposes and means, and acts as controller. When the application processes Microsoft 365 or Azure tenant data on your instructions, you act as controller and NextStep Europe acts as processor.
A data processing agreement covering the Article 28(3) terms — processing only on documented instructions, confidentiality, security measures, sub-processor conditions, assistance with data subject requests, deletion or return at the end of the service, and audit rights — is available on request from the address above.
5. Lawful bases — Article 6
Where we act as controller, processing rests on performance of a contract, steps taken at your request before entering one, our legitimate interests in operating and securing the service, compliance with a legal obligation, or consent where consent is required. Where we act as processor on your documented instructions, your lawful basis governs that processing.
6. Security of processing — Article 32
- Encrypted transport for all network communication.
- Microsoft Entra ID authentication for tenant access; platform sign-in protected by a second factor sent by email.
- Role-based access control and least-privilege access, enforced server-side.
- Session invalidation on password change, and administrative revocation of a user's sessions.
- Rate limiting and cross-site request forgery protection on authentication and write operations.
- An append-only audit log of sign-ins, administrative changes and assessment activity.
- Auditor links that are read-only, scoped to a single framework, and expire automatically.
No electronic system can be guaranteed secure. These measures are reviewed as the service changes.
7. Storage, retention and deletion — Article 5(1)(e)
Microsoft 365 and Azure data retrieved for a live assessment is processed to provide the requested functionality and is not retained as a permanent server-side copy unless retention is required for a feature you have enabled.
The service does retain limited operational information: account and contact records, contractual and consent records, audit events, assessment outputs you have chosen to keep, time-limited auditor-link records, and security or diagnostic logs. Each is kept only as long as necessary for service delivery, security, legal compliance or dispute resolution, then deleted or anonymised. Deleting a tenant from the platform removes its stored evidence and auditor links with it.
8. International transfers — Chapter V
Where personal data moves across jurisdictions, we rely on the safeguards the law requires, which depending on the circumstances may include standard contractual clauses, an adequacy decision, and technical and organisational measures. Microsoft's own transfer commitments govern the Microsoft services the application reads from. If your obligations require processing to stay within a particular region, a self-hosted deployment lets you determine the hosting location yourself.
9. Data subject rights — Articles 12 to 23
Individuals may have the right to access their personal data, to have it corrected or erased, to receive a copy, to restrict or object to processing, and to withdraw consent where processing relies on it. Everyone also has the right to complain to a supervisory authority.
Where the data sits in a customer's tenant, that customer is the controller and we refer the request to them, assisting as the processor. Where we are the controller — account and support records — send the request to support@nextstepeurope.fr. We verify the requester's identity and authority before acting.
10. Sub-processors
We use service providers for hosting, authentication, transactional email, diagnostics and support, engaged only where necessary to provide or protect the service and bound by appropriate contractual terms. A current list is available on request, and the data processing agreement sets out how you are informed of changes and how you may object.
11. Personal data breaches — Articles 33 and 34
We maintain procedures to detect, investigate and record personal data breaches. Acting as processor, we notify the affected customer without undue delay after becoming aware of a breach, with the information needed for that customer to meet its own notification duty. Acting as controller, we notify the competent supervisory authority within 72 hours where the breach is notifiable, and affected individuals where the risk to them is high.
12. Records and impact assessments — Articles 30 and 35
We maintain records of the processing carried out on behalf of customers, as Article 30(2) requires of processors. Where your use of the service calls for a data protection impact assessment, we provide the information about the processing, the categories of data, the security measures and the sub-processors that your assessment needs.
13. Self-hosted deployments
Where you deploy Tenant Excellence inside infrastructure under your control, you determine the hosting location, access controls, configuration and retention settings, and the data stays within your boundary. NextStep Europe accesses such an environment only when you authorise it for support, maintenance or other agreed services.
14. How the design maps to the regulation
| Requirement | How the platform addresses it |
|---|---|
| Lawfulness, fairness, transparency — Art. 5(1)(a) | Access is granted through Microsoft's consent screen, which lists every permission requested before anything is authorised. |
| Purpose limitation — Art. 5(1)(b) | Tenant data is processed to produce the assessment the customer asked for, and is not used for advertising or sold. |
| Data minimisation — Art. 5(1)(c) | Configuration metadata only. Message, file and recording content is outside the permission set. |
| Storage limitation — Art. 5(1)(e) | No standing server-side copy of tenant data; limited operational records with defined retention. |
| Integrity and confidentiality — Art. 5(1)(f) | Encrypted transport, Entra ID authentication with a second factor, least-privilege roles, audit logging. |
| Accountability — Art. 5(2) | Append-only audit log, records of processing, and a data processing agreement on request. |
| By design and by default — Art. 25 | Read-only scopes, content out of scope, administration separated from customer data. |
| Processor obligations — Art. 28 | Processing on documented instructions, confidentiality, sub-processor terms, deletion or return at the end of the service. |
| Security of processing — Art. 32 | The measures listed in section 6, reviewed as the service changes. |
| Breach notification — Art. 33 and 34 | Detection and recording procedures; customer notified without undue delay. |
15. Scope of this page
This page describes how the application is designed and the measures that support your compliance. It is not legal advice, and the GDPR does not offer a certification that a product can hold in its own right — compliance depends on how a controller deploys and uses a tool, not on the tool alone. Your contractual position is governed by the agreement between us and by the data processing agreement, which prevail over this page if they differ. For how personal information is handled in detail, see the Privacy Policy.
16. Contact
Tenant Excellence
Operated by NextStep Europe
Data protection and support: support@nextstepeurope.fr
Data processing agreement and sub-processor list available on request.