Token Watch logo Token Watch  Sign In  Sign Up

Architecture, hosting and encryption

Updated September 7, 2026

Token Watch is a read-only, outbound-only integration. Nothing is installed in your environment and nothing connects inward to it; the only data crossing the boundary is the credential metadata listed on the data page.

Data flow

Token Watch data flow Token Watch, running on Microsoft Azure, makes an outbound read-only HTTPS request to Microsoft Graph. Graph returns App Registration credential metadata from your Microsoft Entra tenant. Token Watch stores that metadata in Azure SQL and sends alerts to the channels you configured. No connection is ever made inward to your environment. Token Watch on Microsoft Azure Your environment Azure SQL Credential metadata Your configuration Encrypted at rest Token Watch App Service (API) Azure Functions (nightly check) Microsoft Graph graph.microsoft.com Enforces the granted permission Your Entra tenant App Registrations Client secrets Certificates Secret values stay here Your alert channels Email · Slack · Microsoft Teams · Azure DevOps · signed webhook 1. GET (read-only) 2. metadata 3. alerts
  1. Token Watch calls Microsoft Graph, once a day on a timer and on demand when the app is opened. The token is one Microsoft issued for your tenant under the granted permission.
  2. Graph returns credential metadata. Graph, not Token Watch, enforces what the token may see, and secret values are not in the response.
  3. Token Watch stores the metadata and delivers alerts to the configured channels. Email is always enabled; the others only if you configure them.

No connection is made into your environment: no agent, no service account, no inbound firewall rule, no VPN, no IP allow-list. Removal is deleting an enterprise application.

Components

Three deployed components and one database, all on Microsoft Azure:

ComponentServiceRole
Web appAzure App ServiceThe single-page app you sign in to at app.aztokenwatch.com.
APIAzure App Service (Linux)Handles the app’s authenticated requests. Validates Entra-issued tokens.
Scheduled jobAzure FunctionsRuns the nightly sync, builds the reports and delivers them.
DatabaseAzure SQL DatabaseEverything listed on the data page.

The marketing site runs as a separate App Service and holds no customer data.

Data location

Infrastructure runs in Microsoft Azure in the United States; credential metadata and configuration are stored there. EU-located infrastructure is available for enterprise customers — email contact@aztokenwatch.com before signing up, since placing a tenant correctly at the start is simpler than migrating it.

The data crossing the border is an inventory of application names and expiry dates, not credential material; the data page lists it in full.

Encryption

  • To Microsoft Graph: HTTPS. Paging links are rejected unless the scheme is https and the host is graph.microsoft.com.
  • To the browser: app.aztokenwatch.com and aztokenwatch.com are TLS-only, with HSTS enabled and plain HTTP redirected.
  • To the database: the connection requires encryption and validates the server certificate.
  • To alert channels: webhook endpoints must be https; plain-HTTP URLs are rejected at save time.
  • At rest: Azure SQL Transparent Data Encryption, enabled.

Tenant isolation

Token Watch is multi-tenant: one application, one database, logical isolation enforced at these points. Every query is filtered by tenant id, taken from the Entra token.

Customer-supplied outbound endpoints

Two optional features cause our servers to call a URL you provide: the custom webhook and the Azure DevOps integration. Both are treated as SSRF surface.

  • Webhook URLs are validated twice. At save time the URL must be https and must not resolve into private, loopback, link-local or cloud metadata ranges. The check runs again at connection time against the resolved IP, so a hostname that later resolves elsewhere (DNS rebinding) fails. Redirects are disabled on that client.
  • Azure DevOps URLs are not fetched as supplied. The organisation and project are parsed out of the URL, and every outbound call is rebuilt from those values against dev.azure.com. The supplied URL is never used as a request target.
  • Webhook payloads on the default JSON channel carry an HMAC-SHA256 signature in an X-TW-Signature header, computed with a per-tenant signing secret, so the receiver can verify origin.

Both are opt-in. Unconfigured, Token Watch makes no outbound call except to Microsoft Graph and the email provider.

Related

Top