Tenant isolation
Every tenant page, API request, invoice, message, incident, support ticket, and audit event is scoped to the authenticated tenant session. A URL identifier is not an authorization grant. Cross-tenant records return not-found or a sanitized permission response.
Role and module boundaries
The portal checks the role permission and module entitlement before protected loaders run. Navigation uses the same requirements, so unavailable pages are not advertised. Write actions retain their own manage checks.
Investigation data
Security Investigator access is structured and metadata-first: sender, recipient, subject, timestamps, scores, model signals, authentication results, indicators, attachment metadata, URL findings, and structured sandbox findings. Full bodies, retained excerpts, screenshots, AI analysis, and containment actions are separately restricted.
Microsoft data
Microsoft 365 and Defender connections use provider consent and server-side calls. EmDash stores connection state and limited identifiers, not raw access tokens. Provider APIs may make some evidence unavailable or delayed; the page explains when Microsoft is authoritative.
Audit redaction
Audit events never include OAuth tokens, credentials, authorization headers, message bodies, attachments, or sensitive provider payloads. SIEM exports contain the same redacted envelope and use stable IDs for safe retry deduplication.