Kyvoi Kyvoi
Home Features Pricing Monitoring Docs AI Agent About Research Sign in Start Free Scan →
Security and data handling

How Kyvoi accesses
your Microsoft 365 tenant

Granting a tool access to your tenant is a serious decision. This page says exactly what Kyvoi reads, what it never does, what it keeps, where it runs, and how you take access back.

How it works, in three steps

1

You approve

A Global Administrator grants read-only access on Microsoft’s own consent screen, where every permission is listed before approval.

2

Kyvoi reads configuration

Through Microsoft Graph, the Exchange Online admin API and Microsoft Purview. Nothing is installed in your tenant.

3

You get the results

A PDF report by email. With Continuous Monitoring, drift alerts in Teams or by email, and a history of every control.

What Kyvoi reads

  • Identity and Conditional Access policies
  • Privileged role assignments
  • Email security settings: DKIM, DMARC, SPF, anti-phishing, forwarding
  • Device compliance and endpoint settings
  • Data protection, retention and audit settings
  • App registrations and service principals

All 93 controls, and what each one checks, are listed at kyvoi.com/features.

What Kyvoi never does

  • Read the contents of email, files or messages
  • Change anything in your tenant
  • See your users’ passwords
  • Install an agent or connector
  • Stay connected after you revoke access

What we keep

We keep the findings and the report generated for your tenant, so you can open them again and track posture over time. With Continuous Monitoring we also keep the history of each control, which is what lets you show that a control held through an audit period.

Access tokens are stored encrypted with AES-256-GCM, and the encryption key is held in Azure Key Vault, not in the database. We do not hold a copy of your email, files or messages, because we never read them.

To ask for your account and reports to be deleted, email support@kyvoi.com. The full policy is on the privacy page.

Where it runs, and who we use

  • Microsoft Azure hosts Kyvoi. The application, storage and secrets run in East US, and the database runs in Central US.
  • Anthropic provides the AI model that writes the report’s advisory and answers questions about a report. It receives the report’s findings, your organisation’s name and your score, and the questions you ask the agent.
  • Microsoft 365 delivers reports and alerts by email, through Microsoft Graph, from a Kyvoi mailbox.

These providers process data only to provide their service to us. They are listed as sub-processors in our privacy policy.

How to take access back

You do not need to contact us. In the Microsoft Entra admin center, open Enterprise applications, select Kyvoi and delete it. That removes Kyvoi’s access to your tenant immediately.

A Global Administrator can also remove the permission grants from the same page.

What it cannot check

Some Microsoft 365 settings have no API at all. Where Kyvoi cannot read a control, the report names it and gives the reason, and never scores it as passing. We wrote up the settings concerned in our research.

Common questions

Why does Kyvoi need a Global Administrator?

Reading Entra, Defender and Purview configuration needs directory-level read access, and only a Global Administrator can grant it. The access itself is read-only.

Can Kyvoi change my tenant?

No. Kyvoi does not request write permissions and cannot change your configuration. Each finding gives you the fix and a link to the admin page, and you make the change yourself.

Can I see a report before I connect anything?

Yes. Email support@kyvoi.com and we will send a redacted sample report.

Is Kyvoi a mature, audited product?

Kyvoi is early. Both products are live on Microsoft Marketplace and bill through Microsoft. We would rather say that plainly than imply a track record we do not have. If you want to talk to the person who built it, that person answers support directly.

Questions about security or data handling go straight to the founder.

Email support@kyvoi.com Who built Kyvoi