Security & Access
OffboardIQ asks for administrative access to your Microsoft 365 tenant. That is a serious request, so this page sets out exactly what we ask for, what we do with it, and what we have not done yet.
What we request, and why
These are the application permissions granted when a Global Admin consents. For each one we list what OffboardIQ actually uses it for, and separately the full scope Microsoft grants. You will see the second column on the consent screen, so we would rather you see it here first.
User.ReadWrite.AllDisable the leaver’s account and reset their password.
Grants: Read and update any user profile in your tenant.
Directory.ReadWrite.AllRevoke sign-in sessions and remove the leaver from groups.
Grants: Read and write directory objects, including group membership.
UserAuthenticationMethod.ReadWrite.AllRemove the leaver’s MFA methods so the account cannot be recovered.
Grants: Read and manage authentication methods for any user.
RoleManagement.ReadWrite.DirectoryStrip admin roles before the password reset, so privileged accounts close cleanly.
Grants: Read and manage directory role assignments.
GroupMember.Read.AllSync employees when you scope OffboardIQ to a single security group.
Grants: Read group memberships. Read-only.
MailboxSettings.ReadWriteForward the leaver’s mail to their manager and set an out-of-office reply.
Grants: Read and write mailbox settings. Not message content.
DeviceManagementManagedDevices.ReadWrite.AllRetire or wipe the leaver’s Intune-managed devices.
Grants: Read and manage Intune-enrolled devices in your tenant.
Files.ReadWrite.AllGive the manager access to the leaver’s OneDrive at day 30.
Grants: Read and write files across the tenant. This is the broadest scope we request — Microsoft offers no narrower one for handing over a single OneDrive.
Access is granted through your own Azure app registration, with a client secret you create and can revoke at any time. Removing consent in Azure cuts OffboardIQ off immediately — there is no separate step on our side.
What OffboardIQ does not do
Broad permissions are not the same as broad behaviour. The pipeline only ever acts on an employee you explicitly start an offboarding for.
- We do not read mailbox content. We change forwarding and out-of-office settings only.
- We do not open, copy, or move your files. The OneDrive step grants the manager access; it never transfers data to us.
- We do not act on anyone you have not selected. There is no bulk or scheduled action across your directory.
- We do not sell data, share it with third parties, or use it to build advertising profiles.
- We do not require standing Global Admin. Consent is granted once; the service then runs under its own app registration.
Where your data lives
OffboardIQ stores the minimum needed to run an offboarding and prove it happened.
| Data | Stored in | What it contains |
|---|---|---|
| Employee records & audit logs | Supabase (managed PostgreSQL) | Names, work email addresses, role metadata, and a step-by-step record of each offboarding. |
| Application & job processing | Railway | Runs the offboarding pipeline. Holds no data at rest beyond logs. |
| Website & dashboard | Vercel | Serves the interface only. It never connects to the database directly. |
| Compliance PDFs | Private MinIO storage | Generated reports, reachable only over an authenticated URL. |
Audit and report history is retained for one year by default and is configurable. See our Privacy Policy for retention and deletion requests.
How access is protected
- Tenant isolation. Every database query is scoped to your organisation from the verified session token. Organisation identifiers are never accepted from the browser.
- No direct database access. The dashboard holds no database key. It talks only to our API, so there is no public path to the data store.
- Encrypted in transit. HTTPS everywhere, with HSTS set to one year including subdomains.
- Restricted origins. The API accepts browser requests only from our own domain; requests from any other origin are refused.
- Role-based access. Owner, admin, manager and viewer roles gate who can start an offboarding, manage the team, or reach billing.
- Rotating credentials. The Azure client secret is rotated ahead of its twelve-month expiry.
What we do not have yet
We would rather you learn this here than in a procurement review.
- No SOC 2 report. We are not certified. If your procurement process requires one, we are not the right fit today.
- No third-party penetration test. The controls above are implemented and verified by us, not audited by an outside firm.
- No independent customer references yet. OffboardIQ runs in production, but the deployments so far are our own. Our results are published in full, failures included.
Reporting a vulnerability
If you believe you have found a security issue, email security@cmdfleet.com with enough detail to reproduce it. We will acknowledge within two business days and keep you updated until it is resolved. Please give us a reasonable window to fix the issue before disclosing it publicly.
Last reviewed: September 2026. Questions about any of the above: security@cmdfleet.com