Security & trust
How rugged.sh reaches your customers' tenants
Access is app-only and scoped per customer tenant, with no standing administrator account. This page lists the mechanisms and every permission the app holds. If you need a security questionnaire answered before connecting a tenant, send it to security@rugged.sh.
Scoped app-only access, no standing admin
A customer's Global Administrator approves one admin consent link, which grants one app registration the Graph application permissions listed below, plus the Owner role on that customer's Azure subscription. The app itself is never given Global Administrator, and we hold no customer admin accounts or user passwords. The consent is visible in the customer's own enterprise applications and can be revoked there.Where data lives, and what it is
Control-plane data is hosted in Azure Canada Central. We store configuration and metadata about your customers' tenants, such as tenant ids, baselines and deployment records. The app holds no permission to read their email, files or chats. On termination, your data is deleted or returned after a 90-day recovery window.Scope checked in the data-access layer
Every row and every operation carries a partner and customer-tenant scope, enforced in the store rather than in each screen, and covered by tests as a correctness invariant. A staff login can be restricted to a subset of customer tenants.Secrets in Key Vault
Application credentials, signing keys and API tokens are read from Azure Key Vault through managed identity, not from application config or source control. One component acquires tokens; the rest of the codebase asks it rather than handling credentials directly.Actions are recorded
Operator and MSP actions are written to an audit trail with the actor, the target and the time. A correlation id travels from the API call to the background job that executes it, so an action can be traced end to end. Audit rows are retained for a configurable window, one year by default.Backups with point-in-time restore
Postgres keeps continuous point-in-time backups for 35 days in the same Azure region, restorable to the second. Separately, a weekly full backup is held for three months in a geo-redundant vault replicated to a second region. In a regional outage the most recent weekly copy is the recovery point, so up to about a week of changes could be lost. The point-in-time restore path was last exercised end to end on 2026-07-17, on a throwaway server with row counts compared against live.Support, and what we do not promise
Platform support is an always-on ticket channel inside the console. We reply usually within one business day, Atlantic time. There is no contractual SLA, no overnight rota and no status page yet; we would rather say that than let you infer one. We are a small team and you will be talking to the people who wrote the code.MFA and email verification
Self-serve signup requires email verification and a second factor, TOTP or an emailed code, before the console is reachable. Sessions use secure cookies over HSTS, and mutating requests are rejected when the origin is neither the app's own host nor a configured allowlist entry.
Every Microsoft Graph permission, and why
13 application permissions on one multitenant app registration, granted when your client's admin approves the consent link. The list is kept in the codebase and this page is checked against it, so a permission cannot be added quietly.
- AuditLog.
Read. All - Sign-in activity, for the licence-waste and helpdesk views.
- CloudPC.
Read. All - Windows 365 Cloud PC inventory and health.
- CloudPC.
ReadWrite. All - Creating Cloud PC provisioning policies, and reprovisioning a Cloud PC.
- DelegatedPermissionGrant.
ReadWrite. All - After a pooled AVD deployment, grants the client's Azure Files storage app the sign-in consent FSLogix profiles need (openid, profile, User.Read), so nobody has to click it by hand.
- DeviceManagementConfiguration.
Read. All - Reading Intune settings for drift detection.
- DeviceManagementConfiguration.
ReadWrite. All - Writing an Intune baseline and remediating drift.
- DeviceManagementServiceConfig.
Read. All - Autopilot device and deployment-profile health.
- Directory.
Read. All - Directory metadata: service principals, organization branding, group names.
- LicenseAssignment.
ReadWrite. All - Assigning and removing licences from the helpdesk, and reclaiming them when a user is offboarded.
- Organization.
Read. All - The tenant's display name and domain, during onboarding.
- Policy.
Read. All - Reading Conditional Access policies for drift detection.
- Policy.
ReadWrite. ConditionalAccess - Writing a Conditional Access baseline and remediating drift.
- User.
ReadWrite. All - Helpdesk user actions: disable, enable, MFA reset and offboarding.
On Azure: the Owner role, per subscription
There is no standing Azure permission. During onboarding the app is given the Owner role on each client subscription you connect, and the console reads that role assignment back before the connection goes live. Owner is broad, and we say so: it is what lets the platform create a host pool and tear it down again. Disconnecting a client stops token issuance for that tenant immediately, and the client can remove the role assignment and the consent themselves at any time.
Questions before you connect a customer?
Email security@rugged.sh or open a ticket and a real person answers.