Overview
Data protection in Turbo360 covers how the platform collects, stores, processes, and retains data from your connected Azure subscriptions and, if you use Tenant Manager, your Microsoft 365 tenants. Understanding these practices helps your organization meet compliance requirements and make informed decisions about data residency and handling.
Business value
Knowing how Turbo360 handles your data allows your security and compliance teams to assess risk accurately, meet contractual obligations, and configure retention and access controls with confidence.
How it works
Data collected by Turbo360
Turbo360 collects and processes the following categories of data from your connected Azure subscriptions and Microsoft 365 tenants:
- Cost and billing data: resource-level consumption data, billing periods, subscription costs, and reservation utilization retrieved from Azure Cost Management.
- Resource metadata: resource names, types, tags, regions, and configuration attributes used for cost analysis, documentation, and monitoring.
- Monitoring telemetry: availability states, metric values, log query results, and alert events collected from Business Applications and Business Activity Monitoring (BAM) modules.
- Microsoft 365 tenant data (Tenant Manager): users (licenses, account status, last sign-in, and multi-factor authentication registration), Microsoft Entra ID groups (members, owners, licenses, and admin roles), licenses and purchases, license and group changes from the audit log, Microsoft 365 usage reports, and seat prices. A sync only reads from Microsoft 365 and never changes anything in your tenant.
- Audit data: user actions performed within the Turbo360 portal, including role changes, resource configuration updates, and subscription management events.
- Authentication data: user identity information (name, email, tenant ID) passed via Microsoft Entra ID during authentication. Turbo360 does not store passwords.
Data storage and residency
- Turbo360 stores collected data in Azure-hosted infrastructure.
- For organizations using private hosting, data storage occurs within your own Azure subscription and infrastructure. You retain full control over storage accounts, regions, and retention policies.
- Turbo360 does not transfer your subscription data to third-party services outside the platform's operational scope, with one exception: AI Agents and Explain with AI features send a subset of resource data to Azure OpenAI to generate responses. This applies only when these features are actively used. See AI features and third-party data processing for full details.
- Tenant Manager keeps a copy of the Microsoft 365 data it reads and replaces it on each sync, which runs every 6 hours. If a sync fails, the copy from the last successful sync is kept. Tenant Manager pages read this copy, not Microsoft 365 live. See How data sync works.
- In Tenant Manager, Explain sends names, email addresses or UPNs, departments, job titles and managers to the AI service. For open tasks, it also sends the email address of the person who raised the task. Turbo360 does not store this data on the server. Your browser keeps the result in memory until you reload the page.
Data retention
- Cost and monitoring data is retained for a defined period to support trend analysis, anomaly detection, and reporting.
- User logs are retained to support compliance review and incident investigation.
- When a subscription is disconnected from Turbo360, associated data is removed completely.
- When you delete a tenant from Tenant Manager, its synced data is deleted with it.
- Tenant Manager does not purge the license and group change history it records from the audit log. The history keeps growing while the tenant is connected, and it is deleted with the tenant.
Encryption
- Data at rest is encrypted using Azure Storage Service Encryption (SSE) with platform-managed keys by default.
- Data in transit between Turbo360 services and your Azure subscription is encrypted using TLS 1.2 or higher.
- Authentication tokens issued during Entra ID SSO sessions are transmitted over HTTPS and are not persisted beyond the session duration.
- The client secret entered for each Microsoft 365 tenant in Tenant Manager is stored encrypted.
Access to your data
- Turbo360's engineering and support teams access customer data only when required to investigate a reported issue, and only with appropriate authorization.
Private hosting data isolation
Organizations using private hosting operate a fully isolated Turbo360 instance within their own Azure subscription. In this configuration, no data leaves your tenant boundary. You are responsible for backup, retention, and encryption key management for all data stored within your private instance.