Documentation & Client Security Trust Portal
ZERO-FOOTPRINT ARCHITECTURE, DUAL-MODE SECURITY BOUNDARY, MSP OPERATOR PLAYBOOK & TWO-TIER CLOUD INFRASTRUCTURE GUIDE
Zero-Persistent-Footprint Security Architecture & Data Privacy Guarantee
Prepared by IT Ninjas, LLC (Primary MSP Platform Operator • NinjaSecure 365 v1.0.5)
1. Zero Standing Footprint
NinjaSecure 365 deploys zero persistent agents, zero custom client secrets, and zero standing certificates in your Microsoft 365 tenant. Authentication uses short-lived (~60 min) delegated OAuth 2.0 PKCE access tokens that expire automatically.
2. Mathematical Read-Only Lock
For assessment clients, every outbound Microsoft Graph call passes through ReadOnlyEgressGuard and TokenClaimValidator, blocking all POST/PUT/PATCH/DELETE mutations and rejecting tokens carrying .ReadWrite scopes.
3. Multi-Tenant Vault Isolation
All assessment telemetry and executive deliverables are isolated via PostgreSQL Row-Level Security (RLS) and private storage paths ({org_id}/{client_id}/{run_id}) with AES-256-GCM encryption and SHA-256 artifact integrity verification.
Diagram 1.1 — End-to-End System Data Flow & Zero-Trust Security Architecture
Vector SVG • Print & PDF ReadyDiagram 1.2 — Dual-Mode Security Boundary: Strictly Read-Only vs. Opt-In Active Management
Hardware-Grade Mode Separation1.3 — Client Onboarding & Least-Privilege Microsoft Graph Permission Matrix
| Operational Mode | Microsoft Graph Delegated Scopes | Purpose & Security Controls Evaluated | Write Capability |
|---|---|---|---|
| Strictly Read-Only Assessment (Default) | Directory.Read.All, Policy.Read.All, SecurityEvents.Read.All, AuditLog.Read.All, Organization.Read.All, SharePointTenantSettings.Read.All, DeviceManagementConfiguration.Read.All | Evaluates 77 Canonical & CIS/SCuBA controls, Secure Score, Conditional Access, MFA coverage, FinOps SKU waste, and configuration drift ($T_0 \leftrightarrow T_1$). | NONE (0% Write Access) |
| Opt-In Active Management — User & License Hub | User.ReadWrite.All, UserAuthenticationMethod.ReadWrite.All, Directory.ReadWrite.All | Block/unblock sign-in, revoke active sessions, reset MFA methods, issue CSPRNG temporary passwords, reclaim wasted licenses, and 1-Click User Offboarding. | Guarded by Step-Up MFA + SHA-256 Audit Log |
| Opt-In Active Management — Baseline Remediation | Policy.ReadWrite.ConditionalAccess, Policy.ReadWrite.Authorization, SharePointTenantSettings.ReadWrite.All, DeviceManagementConfiguration.ReadWrite.All | Deploys 8 hardened security baselines with mandatory break-glass exclusions, pre-mutation JSON snapshots, and 1-click atomic rollback. | Pre-Mutation Snapshot + 1-Click Rollback |
1.4 — Hybrid Identity Engine, Universal In-App TOTP MFA (AAL2) & Scoped ClientViewer Isolation (v1.0.7)
1. Work/School OAuth + Email/Password
Supports Microsoft 365 Work/School SSO (azure) and direct Email & Password authentication. Personal consumer Microsoft accounts (9188040d-6c67-4c5b-b112-36a304b66dad / @outlook.com / @hotmail.com) are automatically blocked on the Azure OAuth flow via isConsumerMicrosoftOAuthUser().
2. Mandatory In-App TOTP MFA (AAL2)
Every authenticated session—including Microsoft 365 OAuth logins—must enroll and verify a NinjaSecure In-App TOTP Authenticator factor to reach aal2 before any dashboard or API route is unlocked.
3. Scoped ClientViewer Portal RBAC
Downstream client stakeholders invited with the ClientViewer role are pinned to a single assigned_client_id via PostgreSQL public.can_access_client(uuid) RLS—granting strict read-only report visibility plus tenant OAuth consent for their own tenant only.
1.5 — 14-Day Trial Export Restriction & Screenshot Security Architecture (v1.1.6)
1. Server-Side Trial Export Enforcement (HTTP 403)
Every self-service organization subscription provisioned during the 14-Day Trial (is_trial = true, allow_export_downloads = false) unlocks full interactive in-app security posture, CIS/CISA control verification, and FinOps dashboards, while strictly blocking downloadable deliverable artifacts (.md, .xlsx, .pdf, .json, .zip) on the server via assertSubscriptionAllowsExportDownloads() across all report/artifact API routes and omitting signed storage URLs from server-rendered payloads.
2. Why Browser Screenshot Blocking Is Not Claimed as a Security Control
Web browsers cannot reliably prevent OS-level screen snipping, external display capture, or DevTools DOM inspection; attempting fake JavaScript/CSS screenshot blockers degrades accessibility and creates false security claims. Instead, NinjaSecure 365 enforces real value protection where it matters: withholding multi-hundred-row Excel companion workbooks, executive Markdown deliverables, and signed evidence packages on the server until paid plan activation.
1.6 — Dynamic M365 SKU Pricing Provenance vs. Azure Retail Prices API (v1.1.6)
1. Microsoft Graph SubscribedSkus vs. Azure Retail Prices API
Microsoft Graph GET /subscribedSkus returns seat counts (prepaidUnits and consumedUnits) and service plans, never dollar prices. Furthermore, the public unauthenticated Azure Retail Prices API (prices.azure.com/api/retail/prices) covers consumption-based Azure IaaS/PaaS meters (VMs, Managed Disks, SQL, Storage) and is NOT an authoritative real-time source for per-seat Microsoft 365 commercial SaaS licensing (NCE Monthly vs. Annual Commitment, EA, or CSP partner tiering).
2. Authoritative Commercial Baseline + Custom Negotiated Override Engine
NinjaSecure 365 pairs a versioned Microsoft Commercial NCE List Baseline (tracking currency_code, market_region, billing_term, effective_date, and pricing_source) with protected Organization / Tenant Negotiated Overrides (is_admin_override = true). Syncing the baseline updates standard retail reference rates while preserving custom EA/CSP negotiated overrides unless explicitly reset.
1.7 — Three-Lens Open Scoring Architecture & Mathematical Specification (v1.2.1)
Lens 1 • Severity-Weighted Posture (0–100%)
Prioritizes real threat surface using the open weight formula: Critical = 4.0, High = 3.0, Medium = 2.0, Low = 1.0, Info = 0.5. Warning controls receive proportional credit or 50% baseline.
Lens 2 • Benchmark Conformance (0–100%)
Unweighted compliance pass rate (Passed / Applicable Controls) directly aligned with CIS M365 Foundations, CIS Azure Foundations, and CISA SCuBA baselines for auditors and compliance teams.
Lens 3 • Microsoft Native Secure Score (0–100%)
Raw telemetry streamed directly from Microsoft Graph SecurityEvents.Read.All (currentScore / maxScore) providing side-by-side reconciliation with Defender portal metrics.
Per-Control Contributor Badges (+X.X% Score Gain) & Open Formula Equations:
Severity-Weighted Posture % = (Earned Pts / Applicable Pts) × 100Score Gain (+%) = (Unattained Control Pts / Total Applicable Pts) × 100Proprietary score branding (e.g. "NinjaSecure365 Score") is fully retired in favor of open, verifiable metrics.
1.8 — AI Governance, Pre-Transit PII Scrubbing & Deterministic Opt-Out (v1.2.1)
1. 0% AI Control Evaluation
All 105 M365 and Azure CSPM controls, FinOps calculations, and drift detections are executed via 100% deterministic, auditable TypeScript code. AI never evaluates controls or determines pass/fail statuses.
2. Pre-Transit PII Scrubbing
Outbound payloads to OpenAI undergo pre-transit stripping: UPNs, emails, Entra GUIDs, IP addresses, phone numbers, and Bearer tokens are redacted; tenant name and domain are pseudonymized to [ASSESSED_ORGANIZATION] and re-hydrated locally post-response.
3. Two-Tier Deterministic Opt-Out
Regulated tenants (HIPAA, CMMC, NCUA) can enforce 100% Deterministic Mode at the tenant policy level or per-report toggle, synthesizing complete executive deliverables via local templates with zero external AI/LLM network calls.