Skip to content
REXIA
ENES

Security

What CredWatch is allowed to see.

CredWatch is being built to read credential expiry dates out of Microsoft Entra tenants. Granting an outside tool access to a client tenant is the decision an MSP has to justify, so the access model is published before the product ships rather than after.

Reads

  • App Registration and service principal directory entries.
  • Client secret and certificate expiry timestamps.
  • Display names and identifiers needed to tell one credential from another.

Never reads or writes

  • Client secret values. Microsoft Graph does not return a secret after it is created, so no integration can read one back.
  • Certificate private keys.
  • Mail, files, users, groups, or directory objects unrelated to application credentials.
  • Nothing at all is written. There is no create, update, rotate, or delete path.

Read-only by construction

CredWatch is designed against the Microsoft Graph application permission that reads application objects. No write permission is requested, so no consented grant can be used to change a tenant.

Rotation is deliberately out of scope. A tool that can renew a credential is a tool that can lock an application out of production, and that is a larger blast radius than the problem being solved.

Consent is per tenant and revocable

Access is granted per tenant through the standard Entra admin consent flow. There is no shared credential and no long-lived secret handed over out of band.

A tenant administrator can withdraw consent in Entra at any time without contacting REXIA. Removing the enterprise application ends the access immediately.

What is stored

The working set is the metadata needed to send an alert: tenant identifier, application identifier, credential identifier, expiry timestamp, and notification state.

Secret values are not stored because they cannot be retrieved. Certificate material is not stored because only expiry dates are read.

Where it runs

CredWatch runs on Microsoft Azure. The hosting region is fixed per deployment so data residency can be stated plainly rather than inferred.

This website is a static export with no server runtime, no database, and no session state. It cannot receive tenant data.

What is not claimed

REXIA holds no SOC 2, ISO 27001, or equivalent attestation, and does not claim one. Auditing an unreleased product would produce a certificate about nothing.

This page describes the access model CredWatch is built against. It is a commitment about scope, not a report on an audited system.

Reporting a vulnerability

Send findings to security@rexia.io. Reports are read by the engineer who wrote the code. Machine-readable contact details are published at /.well-known/security.txt as described in RFC 9116.

security@rexia.io