Security and data residency

Hosted in the UAE

Mito runs entirely in Microsoft Azure’s UAE North region (Dubai):

• the assessment runs, on Azure Kubernetes Service;
• the results database, on Azure Database for PostgreSQL, reachable only from Mito’s private network;
• the stored reports, in Azure Blob Storage behind a private endpoint.

Your tenant’s configuration data is read from Microsoft 365 and stored in those services only. Assessments are scheduled in UAE time (Asia/Dubai).

Read-only access

Mito signs in to your tenant with the app registration you create. That app has only read permissions and the read-only Global Reader role (see Permissions explained). Nothing Mito runs can change your tenant: Microsoft refuses any write request from it, whatever the code tries to do. Mito reports what it finds; fixing is always done by you or your IT provider.

You stay in control of the app. You can see its sign-ins in the Entra sign-in logs (filter on Service principal sign-ins), and deleting it ends Mito’s access.

Your app secret

The client secret you send us is the key to that read-only access, so it is handled carefully:

• It is stored only in your own isolated namespace in Mito’s cluster, as a Kubernetes Secret. It is never written to Mito’s database.
• Each customer has a separate namespace. The assessment for one customer cannot read another customer’s secret or write results for another customer’s tenant: results are accepted only from the verified identity of that customer’s own runner, and only if they are for that customer’s tenant ID.
• Mito’s web application can create and update the secret but cannot read it back.
• Between runs nothing runs in your namespace. A run starts, reads your configuration, uploads the results and stops.
• We track the expiry date and remind you a month before it, so you can rotate it.

What is stored

For each run Mito stores:

• the result of every check (passed, failed, skipped) and the details the check reported, such as the names of policies or accounts that caused a failure;
• the full HTML report of the run.

Mito does not read or store email content, files, chats or passwords. The checks read configuration: policies, roles, settings, and the user, group and app objects they refer to.

Runner isolation

The assessment runs in a locked-down container: not as root, with a read-only file system, no added Linux capabilities and network access limited to DNS, Mito’s results service and HTTPS to Microsoft’s public endpoints. It cannot reach other services inside Mito’s network.

Open-source engine

The checks are open source. Mito’s engine is based on open-source community checks that are publicly reviewed by the Microsoft 365 security community, and on published baselines from CIS, CISA (SCuBA) and Microsoft. Every check is described on this site under Security checks; Open-source licences lists the projects the engine includes.

Reporting a security issue

If you think you have found a security problem in Mito, please contact us through your usual Mito contact rather than a public channel. We will acknowledge it promptly.