How we protect your data.
Documentation on API access, tenant isolation, AI data handling, and compliance.
READ-ONLY MICROSOFT GRAPH ACCESS
Gauge connects to Microsoft 365 tenants via a registered enterprise application. All requested OAuth scopes are delegated and strictly read-only. We do not request or possess the ability to write configurations, reset passwords, or access mailbox content.
Requested scopes:
TENANT ISOLATION
Strict per-customer data segregation is enforced at the database level. Every query is scoped to a single tenant ID.
When sending context to the AI engine, prompts are constructed entirely within one tenant's boundary. Data from one customer is never used as context for another.
AI DATA HANDLING
Gauge sends alert metadata and posture configuration to enterprise model APIs (Anthropic Claude and OpenAI GPT) to generate plain-English explanations and compliance reports.
- No customer data is ever used to train or improve the foundation models.
- Outputs are strictly enforced as JSON to prevent prompt injection and formatting errors.
- Content safety filtering is applied to all outputs before they are displayed.
AUDIT LOGGING
Every AI decision, prompt, response, routing choice and human approval is recorded immutably and is reviewable within the platform. You always know exactly what context the model was given and what it decided.
UK DATA RESIDENCY & GDPR
10/10 Holdings Ltd trading as RORA is a UK-based company and all data processing is GDPR-aligned. A standard Data Processing Agreement (DPA), including current hosting and sub-processor details, is available on request.