Read exactly what we ask for before you grant it
We ask for 3 permissions. Here is exactly what each one lets us do, and what it doesn't. Permissions are application permissions granted by your Global Admin in your own tenant, and we never store customer secrets.
| Permission | What it lets us do | What it does not allow |
|---|---|---|
DeviceManagementApps.ReadWrite.All | AllowsCreate, update and assign the Win32 apps we publish, upload their packages, and read install status. | Does not allowTouch device configuration, compliance or Conditional Access policy, or run any action on a device. Graph cannot scope this permission to our apps alone, so we only modify apps whose name starts with "DC |". |
DeviceManagementManagedDevices.Read.All | AllowsRead the device list and detected apps to count devices nightly for billing and to suggest your starter set. | Does not allowWrite anything, or wipe, retire, sync or reset a device. |
Group.Read.All | AllowsRead group names so you can pick your Pilot and Broad groups. | Does not allowCreate, edit or delete groups, or change who is in them. |
Sign in uses delegated User.Read, openid, profile and email on work accounts only. Personal Microsoft accounts are rejected.
Four checks before a version reaches Bay 1
Every version carries an inspection tag and a QA log you can open without logging in.
1 of 4
Hash
The installer SHA-256 must match the manifest.
2 of 4
Signer
Same signer as the previous version, or the version is held for manual review.
3 of 4
Scan
Malware scan in an isolated sandbox. A detection or a signature database older than 24 h holds publication.
4 of 4
VM
Installed, detected, launched and uninstalled in a clean Windows VM.
While our Windows test lab is being commissioned, the VM check shows as pending on any version it has not tested, and those versions publish to Pilot only.
How we handle your data
- We store tenant IDs, group and device identifiers returned by Microsoft Graph, app and ring metadata, and an audit log. We do not store device contents, user files or user passwords.
- We never hold a customer secret: access to your tenant uses our own app credential with the application permissions your Global Admin granted, and you can revoke consent in Entra at any time.
- Installers are downloaded from the vendor, hashed, scanned and uploaded straight to your Intune tenant. We keep the hash, the signer and the QA log, not a copy of your fleet.
- The audit log is append only and tamper evident: each entry stores the hash of the one before it, and an owner or admin can verify the whole chain from the audit log page. This detects edited, removed or reordered entries; it cannot detect deletion of the very newest entries, so export the log regularly if you need that.
- Data is hosted in the United States today (sub processors below). A UK data region is on the roadmap, not live.
- On account deletion we remove tenant, ring and billing data. Audit entries keep ids only, as the privacy policy says.
What we do and do not claim
- Publisher verification with Microsoft Partner Center is pending. Until it completes, the Microsoft consent screen shows the app as unverified.
- SOC 2 Type 1 is on the roadmap. We hold no certification today and we publish no uptime figure.
- Every app we create in Intune carries the “DC |” prefix, so you can find it and remove it.
- Sub processors are listed in full on the sub processors page. The data processing agreement and security policy are public.
- Report a vulnerability to support@buffersoltech.com.
Connect one tenant and read the audit log yourself.
Free plan, no card.