Trust · for your security review

One admin consent grants Aristo six Microsoft Graph read permissions across your organization; for a person who uses Aristo, it can also read their mail and calendar and send mail as them, only when they ask. Leaders see only teams of 5 or more, and Aristo never trains on your data — SOC 2 is in progress, stated plainly.

counted from Aristo’s own permission list — what it asks for at consent

Download the security pack Sign in · Review and grant the admin consent

13 application permissions, all revocable in Entra5 required

5 required reads 3 opt-in reads 5 opt-in writes

Aristo — Trust, Security & Governance

Everything a security, procurement, or IT reviewer needs, in one place. Aristo is a warm companion, not a watchtower — and every claim here is one we can defend. We state plainly what is in place today and what is in progress, never a certification we don't hold.

Security posture

What's in place today, what's in progress, and what's available on request — the procurement-ready picture.

🕊️ Our honesty rule: Aristo is young. We will not claim SOC 2 "certified" until it is. "In progress" means exactly that — with our current posture and roadmap shown so you can assess risk today.

Data handling — in place today

No training on your data✅ In place

Your content is used only to produce your result, then dropped. Never used to train any model, never leaves the compliant AI boundary. AI calls are stateless and per-request. Three things are kept because you asked: knowledge documents a leader connects, recorded skills a maker imports, and each person’s own receipts and preferences — each under its own page’s retention and erasure controls.

Consent on every action✅ In place

Nothing is sent, booked or changed AS you without your press — every on-behalf-of action is an explicit button-press by the user. What Aristo sends on its own is a Teams message under the daily cap, the weekly sponsor digest email, and three operational e-mails, never written as you: the consumption signal a leader has named a Microsoft account contact for and switched on (at most once a month, audited), the note that tells a person their sandbox access is open, and the challenge that confirms an erased person's own consent to return.

Least-privilege, on-behalf-of✅ In place

The do-it-with-me skills run AS each user (OBO) with minimal scopes. Aristo reads no mailbox until your admin's Exchange Application Access Policy is confirmed — fail-closed — and then only the mailboxes it scopes, only for people who opted in.

Tenant data isolation✅ In place

Each customer's state is partitioned per-tenant (Cosmos partition key) and queried only by that tenant id.

Encryption in transit & at rest✅ In place

TLS everywhere; data at rest encrypted by Azure-managed keys. Customer-managed keys planned for the top tier.

Aggregate-only — five or more people✅ In place

Manager/admin views are aggregate — shown only for five or more people, never who-did-what. We keep only minimal per-user operational state (to message you + count your own wins) — no leader-facing activity trail. Opt-out + deletion honored. The per-person rows of the usage report are read, classed and discarded in one pass; only these counts are kept, and a team line appears only above the five-person floor. The single exception is a named department view under your organization’s named-data contract. Eligible people are included by default unless a privacy exclusion applies; earlier “do not name me” choices remain honored. The five-person floor still applies, and the view shows only a name and cohort membership—never a personal activity ledger, prompts, documents, timeline, or usage ranking.

SIEM / audit-log export✅ In place

The aggregate governance ledger exports to your SIEM (Sentinel/Splunk) as JSON — /api/audit/export, an aggregate-only schema with no per-person activity. The endpoint is operator-keyed: Aristo's operator connects it for you on request.

Certifications & enterprise controls — in progress

SOC 2 Type II / ISO 27001🟡 In progress

Not yet certified (we're early). Controls are being implemented; an independent penetration test + CAIQ/SIG-Lite are planned. Current posture available now.

SSO (SAML/OIDC) + SCIM🟡 In progress

Sign-in to the admin console is via Microsoft Entra today; full SAML/OIDC + SCIM provisioning is on the near-term roadmap.

Data residency / EU boundary🟡 In progress

Hosted in a single named Azure region — Azure Central US — with a geo-redundant store and 4-hourly backups. EU Data Boundary support and tenant-selectable residency are planned for regulated/EU buyers.

GDPR — DPA, DPIA, DSAR🟡 In progress

A Data Processing Agreement is available; a DPIA template, lawful-basis statement, and right-to-erasure (DSAR) flow are in progress.

Accessibility — WCAG 2.2 AA / VPAT🟡 In progress

Built mobile-first and high-contrast; a formal WCAG 2.2 AA conformance audit + VPAT are planned.

BCP/DR + uptime SLA🟡 In progress

Running on Azure Container Apps with managed availability; a formal RTO/RPO + uptime SLA + incident-response commitment are being documented.

On request

Sub-processor list📋 On request

Microsoft Azure — hosting, Graph and Azure OpenAI, which runs the first model. Anthropic — only for an organization that has asked for the backup model. A backup model answers only if your organization has asked for it and the first model fails: the prompt then goes to Anthropic's model through Microsoft Foundry, and Anthropic operates the model and processes the prompt. With the switch off, nothing crosses to the other vendor; a pinned organization never crosses, even with the switch on. Full list + DPAs on request.

Your mandated AI vendor📋 On request

If your policy names a specific AI vendor or model, your tenant can be pinned to it — every Aristo call then routes only there, with no silent fallback to another vendor. Arranged with your team during onboarding.

Graph permission blast-radius📋 On request

The exact scopes Aristo requests, why, and a frank "what a compromise could expose" statement — provided for your security review.

The Graph scopes Aristo uses (and why)

What each permission does — and what you miss without it

Every permission Aristo asks for: what it lets Aristo do, whether it reads or writes, whether it is required, and whether it is granted
Permission	What it lets Aristo do	Reads or writes	Required	State
Reports.Read.All	Copilot adoption Read usage reports to count adoption by team, with at least five people in every named team.	Reads	Required	Not checked
ReportSettings.Read.All	Name visibility Read whether Microsoft conceals names in usage reports; honor that setting.	Reads	Required	Not checked
User.Read.All	Departments Read directory profiles to group people by department. Names require the organization’s visibility policy and each person’s choice.	Reads	Required	Not checked
Organization.Read.All	Licenses Read the organization’s purchased and assigned licenses.	Reads	Required	Not checked
ServiceMessage.Read.All	Message Center Read the organization’s Message Center announcements.	Reads	Required	Not checked
CopilotPackages.Read.All	Agent inventory Read the organization’s Copilot agents, so the register lists agents Aristo did not build. It arrives with the core consent and setup is complete without it; the feature also needs Microsoft Agent 365 licensing. Without it, only agents built with Aristo appear on the register.	Reads	Opt-in	Not checked
LicenseAssignment.ReadWrite.All	Move an approved seat Change license assignments to move a seat ready to activate to a consenting teammate after approval. Without it, Aristo hands your administrator the steps instead of moving the seat.	Writes	Opt-in	Not checked
AppCatalog.ReadWrite.All	Approved app catalog Read and change the organization’s app catalog. Publishing that Microsoft requires an administrator to perform is handed to that administrator. Without it, an approved agent ends as a package for your administrator to publish.	Writes	Opt-in	Not checked
TeamsAppInstallation.ReadWriteForUser.All	Approved app installation Install or remove approved Teams apps for people who requested them. Without it, those people install the app themselves.	Writes	Opt-in	Not checked
GroupMember.Read.All	Approver and leader groups Read membership of the security groups the organization names for access and approvals. Without it, group-based approvals are refused.	Reads	Opt-in	Not checked
Mail.Read	Optional inbox help Read only mailboxes covered by the organization’s verified Exchange policy, for people who chose inbox help. Without it, there is no inbox help and everything else is unchanged.	Reads	Opt-in	Not checked
Mail.Send	Operational email Send email as the application. It comes with the extended consent; Aristo sends its operational email from its own mailbox and does not use this permission in your organization. It can send mail and is not a read.	Writes	Opt-in	Not checked
LicenseAssignment.ReadWrite.All	Optional license writer Separate license-only consent for approved seat moves. It grants no mail or app-installation access. Without it, the move stays off.	Writes	Opt-in	Not checked
User.Read	Your profile Read the signed-in person’s profile.	Reads	Core consent · delegated	Not checked here
offline_access	Keep your sign-in Maintain access the signed-in person granted without asking them to sign in for each request.	Keeps access	Core consent · delegated	Not checked here
Mail.Read	Your email Read the signed-in person’s email for the help they request.	Reads	Core consent · delegated	Not checked here
Mail.Send	Your email reply Send email as the signed-in person, only when that person presses send.	Writes	Core consent · delegated	Not checked here
Calendars.Read	Your calendar Read the signed-in person’s calendar to prepare for a meeting they ask about.	Reads	Core consent · delegated	Not checked here

One admin consent grants Aristo six Microsoft Graph read permissions across your organization; for a person who uses Aristo, it can also read their mail and calendar and send mail as them, only when they ask. Setup needs five of the six reads; CopilotPackages.Read.All (agent inventory) is optional and comes with the same consent. The same click grants five delegated permissions for the signed-in person: User.Read, offline_access, Mail.Read, Mail.Send and Calendars.Read. Mail is sent only when that person presses send. Writes across your organization need the separate, optional extended consent. The extended consent grants its permissions together; each feature still needs its own approval or choice. An administrator can revoke either consent in Microsoft Entra at any time. 18 permissions: 5 required application reads, 5 delegated permissions (1 write), and 8 opt-in application permissions (5 writes). Counted from Aristo’s own permission list — what it asks for at consent. What your organization has granted is checked separately. Not asked at consent: SecurityEvents.Read.All, which reads Microsoft Secure Score. An administrator grants it in Microsoft Entra to add the security pillar; without it, the score is counted without that pillar.

How Aristo reaches your people

Five delivery channels are described below. Every report surface says "Aristo comes to you" — this is that claim, itemized, so a reviewer can check each one rather than take it. The weekly digest email is described in row 5; the optional consumption email is described in row 4. For completeness, two e-mails exist that carry no organization's numbers: the note that opens a seller sandbox after Aristo's operator approves the request, and a consent challenge sent to a person who asked to be forgotten and later fills in a public form again.

1 · The Teams app — a bot, in your tenant

A Microsoft Teams app your admin installs. It is where Aristo speaks: a 30-second digest to your named sponsors each Monday, and a card to the leaders a policy names the day a spending traffic light worsens — checked once daily, never continuously. Unsolicited nudges are capped — one per person per day by default — with a cooldown between them; a colleague's request that needs a leader's answer is delivered outside that nudge cooldown under its own daily ceiling, and a receipt for something a person asked for themselves is never counted as a nudge. One word — "stop" — ends every proactive message until that person says "resume". Every action inside a card is an explicit button-press by the user.

2 · The declarative agent, in Microsoft 365 Copilot

The same app package registers a Microsoft 365 Copilot declarative agent, Aristo Spark (copilotAgents.declarativeAgents in the Teams app manifest). Your people pick it from the agents list in Microsoft 365 Copilot Chat — no portal to open. Scope, stated plainly: it declares no Graph capabilities, carries no sign-in of its own and advertises only four generic functions: one Copilot recipe, a general explanation of credits, a skill-plan hand-off to Teams or the recorder, and a lesson lookup that returns the title, length and links of one short Academy film. It exposes no organization score, strategy, license estate or Skill Shelf action. Your Frontier Score, license and spend figures live on the reports, in the Teams app and in the Office add-in below — with an optional, separate leader-signed agent package your own admin can activate if you want those numbers inside Copilot chat too.

3 · The Office add-in — Word, PowerPoint, Excel

A task pane your admin deploys centrally (or a person sideloads), opened from the Aristo button on the Home tab. After a leader signs in through it, it inserts the organization's counted numbers — the Frontier position, seats waiting for a user, the one move, the department chargeback — into the document being written, from the same composition as the report. It is leader-only: anyone else is told the organization view is for leaders and sponsors and pointed to their own numbers in Teams. Org-level aggregates only, never a person.

4 · Exports — what a leader carries out

Each of the three reports leaves as a PowerPoint deck (the Frontier Firm Report in four room-specific versions — board, finance, IT, seller), and, where the spoken brief is enabled for your organization, the Frontier Firm Report also as an audio brief. Every export is generated for a signed-in leader — on request, or on a schedule a leader set — from the same counted composition the page shows, so an export and the page agree at the moment of generation; a filed export is frozen from then on while the live page moves, and both carry the same basis words. Nothing is published or sent anywhere on Aristo's own initiative, with one standing exception a leader must switch on: when a leader names a Microsoft account contact and opts in, Aristo e-mails that contact an org-level consumption signal (spend against budget, no person, no department) at most once a month — every send is in the audit trail as seller-upsell-90.

5 · Weekly digest email

The sponsor’s weekly digest is also sent by Aristo from our support desk when email delivery is enabled. Every email has a personal stop link that opens /digest/stop; use it to stop or restart your digest email. Delivery preferences are in Settings → Notifications.

🕊️ Why this section exists: the product's own promise is that nobody has to spend their day inside it — the answer arrives in Teams, in Copilot, or in the deck they are already presenting. A promise like that is only worth making if a reviewer can enumerate every channel it hides behind. That is the whole table.

Governance ledger

Care, not surveillance — the aggregate record of how Aristo behaves, and the lines it will never cross.

—

Tasks done with explicit consent

—

Nudges today (under the cap)

—

Opt-outs honored

—

People Aristo has met

Sign in to your Aristo workspace (or open the illustrative organization) to see live aggregate numbers for a tenant. The guarantees below always apply.

No pressure, ever

At most 1 proactive message per person per day, with a cooldown between them. One word — "stop" — silences Aristo instantly and for as long as that person likes, no friction; only their own "resume" brings it back.

Every action is consented

Actions on your behalf require your own press. With admin consent, Aristo also acts as the app: Teams messages, the weekly sponsor digest, and a seat move after a leader approves it. Three operational emails are sent as the app: an enabled consumption signal to a named account contact, a sandbox-access notice, and a return-consent challenge. Named department views follow the organization’s visibility policy, each person’s naming choice and the five-person floor; personal activity stays private.

Least privilege

The writes are named in the permission table above: the extended consent’s application writes, off until your admin grants that consent, and delegated Mail.Send, which sends a person’s own reply only on their press. The do-it-with-me drafting runs as each user (on-behalf-of); no mailbox is read until your Exchange Application Access Policy is confirmed, and Aristo asks only for what a given action needs.

No training on your data

Your content is processed transiently to produce a result, then dropped. It is never used to train models and never leaves the compliant boundary of the AI service. What is kept is what you chose to keep — connected knowledge documents, imported recorded skills, and a person’s own receipts and preferences — each with its own retention and erasure control.

Aggregate only — by design

Manager and admin views are aggregate — shown only for five or more people, showing health and never "who did what." The only per-person data we keep is the minimal operational state needed to reach you in Teams and count your own wins — never a leader-facing activity trail — and it is opt-out and deletable. The single exception is a named department view under your organization’s named-data contract. Eligible people are included by default unless a privacy exclusion applies; earlier “do not name me” choices remain honored. The five-person floor still applies, and the view shows only a name and cohort membership—never a personal activity ledger, prompts, documents, timeline, or usage ranking.

What Aristo deliberately does not keep

No per-person "who used what, when" surveillance log.
No stored copies of your emails, meetings, or documents.
No content shared across tenants, and none used for model training.
No manager visibility into any individual’s activity. If the organization enables a named department view, it may show only a name and cohort membership after privacy exclusions and the five-person floor — never prompts, documents, timelines, or a usage ranking.

Leaving Aristo — your data and your copy

Aristo keeps the knowledge documents you connect, the skills you import, and each person’s own receipts and preferences, under their retention and erasure controls.

Your GitHub files stay yours in your organization’s repository. Your Microsoft data stays yours under your organization’s Microsoft 365 retention and compliance rules. Disconnecting Aristo does not erase either.

Before leaving, each person can use Download my records on Where your answers go to take a copy of their own records. Keep your published GitHub files in your repository. Ask Aristo support for the aggregate audit export; Aristo’s operator connects it for you on request.

To leave during the pilot, write to Aristo support. An accountable operator freezes new work, removes the organization’s pilot data, checks for anything left behind and revokes Aristo’s access. Your completion record is provided once its publication is confirmed. The operational proof of the offboarding remains.

Where your answers go — Download my records · Write to Aristo support

The Aristo covenant →Where your answers go →Privacy policy →Terms of use →Support →

Questions for security review? A full DPA, sub-processor list, and SOC 2 status are available on request — email us. A PhoenixHalo product.

A person answers within one business day — email us · or say help, stop, resume or tip to Aristo in Teams.