Privacy Policy

The ComputerGuru AI Remediation application is an internal MSP security tool used by Arizona Computer Guru LLC technicians to perform point-in-time security investigations on client Microsoft 365 tenants. It is not a commercial software product and is not available to the general public.

The application accesses client tenants exclusively through Microsoft admin consent, granted by the client organization's global administrator. Access is never obtained without explicit, verified authorization from the client organization.

When performing a security investigation, the application may read the following data from the client Microsoft 365 tenant via Microsoft Graph API and Exchange REST API:

• Sign-in logs and authentication history (interactive sign-ins, 30-day window)
• Mailbox inbox rules, including rules not visible through standard Outlook interfaces
• Mailbox forwarding configuration (ForwardingAddress, ForwardingSmtpAddress)
• Mailbox delegate permissions and SendAs grants
• OAuth2 permission grants and application role assignments for individual users
• Registered authentication methods (MFA methods, creation dates)
• Directory audit logs (30-day window, scoped to the investigated user)
• Identity Protection risky user signals and risk detections
• Recent sent items and deleted items (read for anomaly detection; limited to 25 items)
• Basic user profile attributes (display name, UPN, account status, password change dates)

Data accessed through this application is used solely for the following purposes:

• Identifying indicators of account compromise, unauthorized access, or credential theft
• Detecting malicious inbox rules, unauthorized forwarding, or suspicious OAuth grants
• Producing a written security investigation report delivered to the client organization
• Performing authorized remediation actions (session revocation, forwarding removal, etc.) at the client's explicit request

Arizona Computer Guru LLC does not maintain a persistent database of client Microsoft 365 data obtained through this application. Specifically:

• No client mailbox content is retained after the investigation session
• No sign-in log data is stored in ACG systems beyond the session
• Investigation reports are retained in ACG's secure, encrypted internal systems as part of the client service record, consistent with standard MSP documentation practices
• Client data is never sold, licensed, or shared with any third party

This application operates exclusively under the following access controls:

• Admin consent required: The application cannot access any tenant without a global administrator explicitly approving access through Microsoft's admin consent flow
• Authorized technicians only: Only credentialed Arizona Computer Guru LLC staff members have access to the application credentials and tooling
• On-demand only: The application does not run continuously or on a schedule. It is invoked only when an authorized investigation is in progress
• Consent revocable: Client organizations may revoke access at any time through their Microsoft Entra admin center (Enterprise Applications → ComputerGuru AI Remediation → Delete)

For questions about this privacy policy, to request information about what data was accessed during an investigation, or to revoke consent:

Arizona Computer Guru LLC may update this privacy policy as the application's capabilities or our data practices change. The effective date at the top of this page reflects the most recent revision. Material changes will be communicated to active clients.