Security
Security you can check, not just trust.
You’re the person who approves the consent screen, so here’s exactly what Brewix Desk asks for and how it looks after your data. Brewix Desk is in development: this page describes how it’s built, and we’ll add audits and certifications here as they happen.
Microsoft sign-in only
Everyone signs in with Microsoft Entra ID, so your MFA and Conditional Access policies apply. There are no Brewix passwords to steal, and roles decide who sees what.
Organizations kept apart in the database
Every row belongs to one organization, and the database itself refuses to return another organization’s rows. If a check is ever missing, the query fails instead of leaking.
Read-only unless you say otherwise
Connecting Microsoft 365 grants read access only. Anything that can change a device is a separate permission an admin grants later, and can withdraw.
One mailbox, not all of them
Mail permission is scoped by an Exchange policy to the help mailbox you choose. Brewix is never granted access to everyone’s mail.
Email treated as hostile
Incoming HTML is cleaned before anyone sees it, and attachments are scanned before they can be opened.
An audit trail you can read
Sign-ins, setting changes, permission grants and device actions are written to an append-only history that admins can review.
AI with guardrails
Names and secrets are removed before a ticket goes to Claude. AI suggestions are labeled and can’t send anything on their own, and an admin can turn them off.
No keys lying around
Brewix is built to run on Microsoft Azure in the US, authenticating with managed identities rather than stored secrets. The MCP server uses OAuth, not API keys.
Microsoft 365 Permissions
Every permission, and why.
This is the same list an admin sees in Brewix under Settings > Integrations. Nothing here can change your directory, your policies or anyone’s account.
Granted when you connect Microsoft 365 Read-only
| Permission | Type | What it’s for |
|---|---|---|
User.Read.All | Application | People: names, departments, job titles and licenses |
Organization.Read.All | Application | Your organization’s name and its license subscriptions |
AuditLog.Read.All | Application | When each person last signed in, to find unused licenses (needs Entra ID P1) |
Device.Read.All | Application | Devices registered in Entra ID |
DeviceManagementManagedDevices.Read.All | Application | Intune devices: model, Windows version, compliance and last check-in |
Mail.ReadWrite, Mail.Send | Exchange | Read and send email in the help mailbox only, scoped by an Exchange policy |
openid, profile, email, User.Read | Delegated | Signing in with work accounts |
Only if an admin turns on device actions Optional
| Permission | Type | What it’s for |
|---|---|---|
DeviceManagementManagedDevices.PrivilegedOperations.All | Application | Device actions from a ticket: sync, restart, remediation scripts and Remote Help |
DeviceManagementConfiguration.Read.All | Application | The remediation scripts in Intune, for an admin to approve |
BitlockerKey.Read.All | Application | A device’s BitLocker recovery key, shown once to the admin who asks, never stored |
Until an admin grants these, Brewix only reads devices and never changes them. Showing a BitLocker key asks the admin to sign in again first.
Your Data
What we keep, where, and for how long.
- Where it lives
- Microsoft Azure data centers in the United States.
- What we store
- Tickets, replies and attachments; the people, devices and licenses Brewix reads from Microsoft 365; and your settings. Never passwords or BitLocker keys.
- Encryption
- Encrypted in transit with TLS and at rest by Azure.
- Backups
- Point-in-time database backups, plus a nightly export of each organization’s data.
- Leaving
- Export everything whenever you like. When you cancel, your data is deleted after 30 days.
- AI processing
- Only when an AI feature is used, with names and secrets removed first. Your tickets aren’t used to train models.
Found a security problem?
Please email security@brewix.io with what you found and how to reproduce it. We’ll reply within two business days and keep you updated until it’s fixed. Please give us a reasonable time to fix it before telling anyone else. Our security.txt has the details.
Brewix Desk is nearly ready.
It isn’t open yet. Join the waitlist for short updates as it gets closer, tell us what makes IT hard for you, and hear first when the founder price opens: $59 a month for the first 25 teams, for as long as they stay.