Privacy notice
How the portal handles data.
Billed via Microsoft Marketplace
Last updated: 2026-10-16
This portal is designed to collect only the minimum inputs required to produce an assessment run and its output files.
Quick links
Data you provide
- Scenario selection and assessment parameters (e.g., target domain).
- Contact details when required to generate an assessment.
- Optional notes you enter (avoid secrets).
Personal data categories can include business contact details (such as work email), organization identifiers, and operational request metadata needed to deliver your requested assessment.
Generated data
- Run status/progress metadata.
- Generated report/result files made available for download.
How we use and share data
- We use data to operate the portal, run requested assessments, generate deliverables, and provide support.
- Access is limited to authorized personnel and approved subprocessors required to provide the service.
- We do not sell customer personal data.
- Where required by law, we may disclose limited data to competent authorities.
See Subprocessors and Data Processing Agreementfor processing roles and commitments.
Evidence uploads
When enabled for a scenario, evidence files can upload from your browser to a designated storage workspace. The portal UI does not retain those uploaded files. MSC processes run data and handles generated outputs and operational metadata separately under the retention terms below. Connecting a workspace alone does not deliver generated outputs into it.
When a Messaging Assessment Generator Architect run is available for your journey, you will need an active subscription before starting it. MSC can hold the resulting files under these retention terms without a Jump Drive connection. You may submit the evidence supported by that release; reviewed image and file readings and examples marked as mock rather than verified are distinct from original-file uploads. Original-file uploads are not available for Architect runs yet. Connecting your Azure Blob workspace sets up your Jump Drive but does not make an unavailable stage available. Check your journey's current availability before supplying information.
Cookies and browser storage
- This portal uses browser storage (localStorage/sessionStorage) for functional settings such as UI preferences and run continuity.
- We do not use browser cookies for advertising purposes in this portal experience.
- If operational cookies are introduced in future releases, this page will be updated with their purpose and lifetime.
Retention
Our retention periods apply to information MSC holds, not to copies saved in your own Jump Drive. You control retention, backups and deletion in your Azure Blob account. MSC remains responsible for information it processes or holds while delivering your results.
- Standard request metadata: 365 days for traceability, transaction and billing support. Assessment answers and report contents are not request metadata.
- Audit trail: 730 days.
- Standard generated output files created for your request: up to 365 days. For a protected Jump Drive stage, MSC removes its temporary stage-result copies after delivery and access from your destination are verified.
- Jump Drive delivery receipts: 730 days from receipt creation, unless a legal hold or other mandatory retention duty requires longer preservation.
- Paid Journey configuration with an accepted Amplify entitlement: restorable; kept until you delete the Journey, or for up to two years after your last active subscription ends, whichever comes first. Once a configuration snapshot is saved and verified in your Jump Drive, MSC removes its server copy.
Paid Journey configuration stays restorable. Once it is saved to your verified Jump Drive, that snapshot is the operational copy, and MSC removes its server copy after the save is verified, except while an active run needs it. Where no Jump Drive snapshot exists, MSC keeps the configuration until you delete the Journey or for up to two years after your last active subscription ends, whichever comes first, subject to records we must legally preserve. Deletion is handled through an identity-verified support review.
Removing a stage's temporary result copy is not the same as deleting its saved Journey or the records needed for delivery, transactions and security. Scheduled expiry is not operating for every category, so listed periods do not prove automatic deletion. Deletion requests are checked against records we must legally keep. See the Data Processing Agreement for current processing terms.
Security safeguards
- Encryption in transit and at rest for service data.
- Role-based access controls and least-privilege operational access.
- Logging and audit trail controls for security and support operations.
Additional details are available on the Security page.
Your rights and requests
You can request access, correction, deletion, or export of applicable personal data through the engagement support channel.
See Data subject requests for request handling guidance.
Payment data
Billing for this service is performed by Microsoft through the Microsoft Commercial Marketplace. Microsoft, not MSC/LuiT, processes payment instruments, taxes, invoices, and refunds for the subscription. The portal receives only the subscription identifier and metering events required to operate your plan.
Contact
For privacy questions or data requests, use the support contact referenced by your engagement or the support channel on Support.