Trust Center
Everything your security review needs, in one place.
Doclave manages access to documents in your Microsoft 365 tenant. Here is how we connect, what we hold, and the documents your team will ask for.
Last reviewed: October 2026
Your Microsoft 365 tenant
Dynamics 365
Roles and records
Roles decide access
SharePoint
Your documents, folder by folder
Permissions only. Never document content.
Doclave
Hosted in the EU
Holds
Reference IDs and access history
Never holds
Your documents or their content
01 — At a glance
The short version.
Documents
Your documents stay in your tenant.
Doclave manages access. Documents never leave Microsoft 365.
Hosting
Run from the EU.
Hosted in EU data centres and backed up on a 3-2-1 model.
Logs
Reference IDs, not names.
Logs hold reference IDs, never names or email addresses.
History
Protected against edits.
Every access change is recorded and can't be altered afterwards.
Visibility
Sensitive details hidden by default.
Only users with the right role can reveal sensitive data.
Partner
Approved Microsoft partner.
Coming to AppSource.
02 — How Doclave connects
Your IT team stays in control of every permission.
Doclave connects to your Microsoft 365 tenant through an app your IT team approves in Microsoft Entra. It sets folder permissions in SharePoint, and your documents never leave your tenant.
Approval
We recommend admin consent, so your IT team approves Doclave once for the whole organisation in Microsoft Entra. Doclave uses a single app registration, which your admin can review or revoke at any time.
Sign-in
Your users sign in with their own Microsoft Entra ID accounts, under your MFA and conditional access policies.
Folder permissions
Read or write on a SharePoint folder follows read or write on the matching Dynamics 365 record. We never request full control of all sites.
Readiness assessment
Needs read access only, and can run with a read-only security role. It reads permissions and Dynamics 365 data, never document content.
Removing Doclave
Delete your account in the customer portal, and a guided offboarding takes you through the rest: restoring standard SharePoint integration if you want it, removing the Dataverse solution and the app, ending the subscription, and deleting your users and data.
Permissions the app requests
Six permissions in one app registration. Your Entra admin sees the same list when approving Doclave.
Permission
Type
Admin consent
Why we need it
Dynamics 365 · user_impersonation
Delegated
No
Reads and writes Dataverse records for the signed-in user, within that user's own security role.
Microsoft Graph · Group.ReadWrite.All
Application
Yes
Creates and maintains the Entra ID groups Doclave uses to grant access. Microsoft offers no narrower scope, so Doclave keeps a register of the groups it created and changes only those.
Microsoft Graph · User.Read
Delegated
No
Shows the signed-in user's own name.
SharePoint · AllSites.Read
Delegated
No
Lets users follow links to documents in other sites, with their own access. Doclave's backend gains no access from it.
SharePoint · AllSites.Write
Delegated
No
The same for editing. It never goes beyond what the user can already do in SharePoint.
SharePoint · Sites.Selected
Application
Yes
Creates folders and files and sets permissions, only in the sites your admin grants Doclave access to.
03 — Your data
What we hold, and what we don't.
What we hold
Reference IDs for users, roles and records
Access change history
Sign-in details for your users
Readiness assessment results, without sensitive customer data
What we don't hold
Your documents or their content
Names or email addresses in access logs
Where and how long
Location
Microsoft Azure, EU. Primary in Ireland, redundancy in Denmark, off-site backup in Germany.
Access change history
12 months
Sign-in log
12 months
Technical logs
90 days
Assessment results
12 months
On termination
Export on request within 30 days. Deleted from active systems within 60 days, and from backups within six months. Deletion confirmed on request.
04 — Documents
The documents your team will ask for.
Public documents are linked below. Contract documents are shared when we agree terms.
Public
05 — Our own security posture
Where we stand, and where we're going.
In place
Hosted on Microsoft Azure in the EU, backed up on a 3-2-1 model
Encrypted in transit (TLS 1.2+) and at rest (AES-256)
Multi-factor authentication on all administrative access
We never request full control of all sites. Doclave grants read or write to individual folders only
Access history protected against edits
Planned
Microsoft publisher verification, before launch
Independent penetration test
Doclave supports alignment. It doesn't replace your legal, security or compliance obligations.
06 — Report a concern
One address for anything security-related.
Questions, suspected vulnerabilities and incidents all go to security@doclave.com. The whole team receives it.
Vulnerabilities
Email security@doclave.com with a description and the steps to reproduce it.
Personal data breaches
We notify affected customers without undue delay, and within 72 hours at the latest.
NIS2 reporting
If you are subject to NIS2, we provide reasonable assistance with your own incident reporting.
Data subject requests
Your organisation is the primary contact. Requests we receive are forwarded to you without undue delay.
Ready to see your own environment?
Run a readiness assessment and share this page with your IT lead.
