Token Watch
Certifications and security controls
Updated September 7, 2026
Token Watch holds no SOC 2, ISO 27001, or comparable certification. What this page can do is set out the control areas those audits examine and what is implemented for each.
Control areas
| Least privilege | One read-only permission against one Graph endpoint, with no write capability of any kind. Permissions. |
|---|---|
| Access control | Per-tenant query scoping, explicit administrator approval of every new user, and roles. Tenant isolation. |
| Cryptography | TLS in transit on every hop, Transparent Data Encryption at rest, HMAC-signed webhook payloads and consent state. Encryption. |
| Data minimisation | Fields that are not needed are never deserialised out of the Graph response. Data held. |
| Audit logging | Every action taken against a tracked credential inside Token Watch is recorded with its actor and timestamp, alongside the monitoring reports. Both are retained for 180 days. Detail below. |
| Retention and disposal | Defined retention per category, and a single-transaction hard delete on request. Retention and deletion. |
| Supplier management | A published inventory of every subprocessor and what each one receives. Subprocessors. |
| Vulnerability management | A disclosure process with stated acknowledgement and assessment targets. Reporting a vulnerability. |
| Incident response | A 72-hour notification commitment to affected tenants, itemised against the data inventory. Incident notification. |
Audit logging
Token Watch records an audit entry for every action taken inside the product against a tracked credential or the configuration around it, with the acting user and a timestamp on each entry. That covers turning tracking on or off for a credential, enabling or disabling monitoring for an application, changes to monitoring and reporting settings, changes to alert recipients, webhook and Azure DevOps configuration, and changes to users and their roles.
The monitoring reports are kept alongside it: one per tenant per day, recording the credentials it covered, the recipients it went to, and the per-channel delivery timestamps. Together they reconstruct who changed what, and what was reported when.
Both are retained for 180 days, then aged out. A tenant deletion request removes them immediately regardless of age, along with everything else held for that tenant. The audit log is visible to administrators inside the application and is not editable from the interface.
What is missing
The gap is the independent audit, not the practice underneath it. Certification requires an assessor, an observation window, and a recurring cost, and Token Watch is an independent product built by one engineer. If your procurement process requires a current certificate, Token Watch does not meet that requirement today.
If your process allows a documented review of a vendor’s controls instead, this section is built to serve as one. Questions that go past what is written here reach the person who wrote the code, at contact@aztokenwatch.com.
Related
- Security contact and incidents — vulnerability reporting and incident notification.
- Retention and deletion — retention periods per category.
- Architecture, hosting and encryption — the technical controls behind several rows above.