Privacy policy & terms
Last updated 2 November 2026. Plain language first: the tools process your data in your browser, OpsVantage does not run a server that receives it, and we do not sell or share anything.
Privacy policy
This policy covers the website tools.opsvantage.net and the tools on it ("the tools"), provided by OpsVantage ("we"). The IOC Triage browser extension has its own privacy policy.
What the tools do with what you paste or upload
The IOC Extractor, Email Header Analyzer, Windows Event Triage and M365 Sign-in Review run entirely in your browser. Text you paste and files you open are processed on your device and are not sent to us or anyone else. Closing or reloading the page discards them.
Tools that make network requests
- SPF, DKIM & DMARC Checker: the domain names you check are looked up directly from your browser through Cloudflare's public DNS resolver (1.1.1.1), falling back to Google Public DNS. Those providers receive the DNS queries under their own privacy policies. We do not.
- M365 Posture Scanner: talks directly to Microsoft. See the section below.
What is stored in your browser
We set no cookies. The site stores two small preferences in your browser's local storage: your light or dark theme choice, and, if you type one, the "Prepared by" name for scanner reports. During a Microsoft sign-in, a one-time code verifier is held in session storage and deleted as soon as you return.
Hosting, fonts and analytics
The site is hosted on Cloudflare Pages. Like any web host, Cloudflare processes connection data such as your IP address and browser type to deliver the pages and protect them from attacks, and may count anonymous, cookie-free page views (Cloudflare Web Analytics). Fonts are loaded from Google Fonts, which receives your IP address when the fonts download. The M365 Posture Scanner page blocks all third-party scripts with a strict Content Security Policy.
What we do not do
- No accounts, advertising, or tracking across sites.
- No selling, renting or sharing of personal data.
- No use of your data to train AI models.
M365 Posture Scanner
The scanner reviews the security configuration of a Microsoft 365 / Microsoft Entra ID tenant when someone with access to that tenant signs in.
How the data flows
- You sign in with Microsoft. Microsoft issues a short-lived access token directly to your browser tab. No refresh token is requested, and the token is kept in memory only, never written to storage.
- Your browser calls Microsoft Graph and builds the report on your device. Tenant data never reaches an OpsVantage server; there is no backend that could receive it.
- For each verified email domain, the scanner runs the same public DNS lookups as the DMARC Checker.
- Reports exist only on your screen and in files you choose to download. Closing the tab ends the session.
Permissions requested (delegated, read-only)
| User.Read | Sign you in and read your basic profile |
| Directory.Read.All | Users, guests, groups, admin roles and app consents |
| Policy.Read.All | Conditional Access, security defaults, consent and guest settings |
| AuditLog.Read.All | Last sign-in dates and the MFA registration report |
| UserAuthenticationMethod.Read.All | Which MFA methods users have registered |
| SecurityEvents.Read.All | Microsoft Secure Score |
| IdentityRiskyUser.Read.All | Users flagged at risk by Entra ID Protection |
Delegated permissions only work within what the signed-in account can already see. The scanner cannot change, create or delete anything.
Removing access
A tenant administrator can remove the scanner at any time: Microsoft Entra admin center > Enterprise applications > "OpsVantage M365 Posture Scanner" > Properties > Delete. This revokes the consent for the whole tenant.
Terms of use
Authorised use only
Only scan Microsoft 365 tenants, domains, logs and data that you own or are authorised to assess. If you are a service provider, make sure your agreement with the client covers security reviews.
No warranty
The tools are provided free of charge, "as is" and without warranty of any kind. Findings are automated and can be incomplete or wrong; verify them before acting, and do not treat them as a substitute for a professional security assessment or audit.
Limitation of liability
To the extent the law allows, OpsVantage is not liable for any loss or damage arising from use of the tools, including decisions made on the basis of their results.
Acceptable use
Do not use the tools to attack, overload or probe systems you have no permission to test, and do not try to disrupt the site.
Changes
We may update this page; the date at the top shows the latest version. Material changes affecting the M365 Posture Scanner will be noted on the scanner page.
Contact
Questions about privacy or these terms: hello@opsvantage.net.