Local-first by design.
No relay. Your content never touches our servers.
MungePoint File Manager is a desktop application. Every API call runs directly from your machine to Microsoft’s Graph API. We have no servers in the data path, not even ours. Built so procurement and CISOs don’t have to take our word for it.
+ local SQLite
Entra ID
Three destinations. Only Microsoft carries your content.
The application talks to three kinds of destination. Tenant content travels only to Microsoft. The other two never touch your data.
- Microsoft Graph / SharePoint REST. Direct from your desktop to Microsoft. Carries your file operations. Authenticated as you, scoped to your permissions.
- Anadak licensing service. Only while Pro is active: at activation, then about every 4 hours. Sends license key, a random installation ID, OS and app version (and device name at activation). Never sends tenant data.
- Update service. Checks for and downloads signed updates. Sends installed version, OS, architecture and release channel. No user or tenant identifiers.
The negative list.
Most security pages tell you what they do with your data. We start with what we never see.
SharePoint file content
Never sent to Anadak. File content moves only when you open, download, sync, copy or move files, directly between your device and Microsoft.
File or folder names
Path information stays on your machine. Never sent to Anadak or any third party.
Tenant structure
Site URLs, library names, group memberships, local only. We can’t see your tenant topology.
Your job history
File listings, job history and logs stay in local databases on your machine. No phone-home, no aggregate benchmark service.
User identities or credentials
Authentication runs through Microsoft. We don’t store or proxy any credential material.
Usage telemetry
No “anonymous usage stats” sent. No event stream from the app to us. Usage telemetry is off by default and, like diagnostic logs and crash reports, stays on your device unless you choose to send it to us.
Your account. Your access. Your boundaries.
By default File Manager uses delegated permissions through Entra ID: the app can only see and act on content your own account can see and act on, and runs no background agent in your tenant. An optional service-account mode instead uses application permissions that your administrator grants to your own app registration; administrators can disable it by policy.
- Delegated by default. The app acts only as the signed-in user, within that user’s permissions.
- Anadak’s multi-tenant app, or your own. Consent creates the standard enterprise-application entry in your tenant, which you can restrict to assigned users, or replace with your organization’s own app registration by policy.
- Honors Conditional Access. Device compliance, location, MFA, all enforced.
- Your organization stays in control. Restrict sign-in to your tenant, disable service-account sign-in and local automation, and control updates by machine policy.
- AI assistants stay local. An assistant can reach File Manager only from the same computer and the same user account. Policy can turn this off or allow read-only access.
- Auditable in Microsoft 365. Every action File Manager takes shows up in your tenant audit logs as your user.
Four. With roles, data, and regions disclosed.
They run our website, downloads, licensing and checkout. None receives tenant data. Microsoft 365 is your own service: the app talks to it directly, not through us.
| Provider | Role | Data they receive | Region |
|---|---|---|---|
| Microsoft Azure | Hosts the Anadak licensing service | License key, random installation ID, OS, app version, device name at activation; email if you request or recover a license. Never tenant data | Microsoft Azure |
| Lemon Squeezy | Checkout, payments | Email, billing details (only at purchase) | US (covered by SCCs) |
| Cloudflare | Marketing site CDN, downloads, update channel | IP, HTTP metadata for mungepoint.com only, never tenant data | Global CDN |
| Google LLC | Marketing-site analytics + web fonts | Cookies + page views, consent-gated, mungepoint.com only | US (SCCs) |
Sub-processor changes announced via Articles.
The page your security review team is looking for.
Common procurement and CISO questions, answered without a sales call.
Need a security questionnaire filled? Email [email protected] with your form. Most are returned within 3 business days.
Honest disclosures, instead of vague claims.
The fastest way to lose enterprise trust is to overstate compliance posture. Here’s what we don’t carry today and what we’re doing about it.
- No SOC 2 Type II. Smaller company. SOC 2 audit on the roadmap; will be transparent about the timeline when committed.
- No ISO 27001. Same reason. Architecturally we avoid most ISO 27001 scope by not holding customer data.
- No formal DPA template. Not strictly required given the local-first architecture (Anadak rarely qualifies as a “processor” for tenant data), but we will sign customer-supplied DPAs on request.
- No WCAG 2.1 AA audit. Self-attested today. A third-party audit is planned.
- TLS 1.2+ everywhere
- OS-level disk encryption support
- OAuth2 / MSAL delegated auth
- Public privacy policy + sub-processor list
- Customer-supplied DPA on request
- Local DB at-rest encryption (optional)
- Third-party WCAG 2.1 AA audit
- SOC 2 readiness assessment
Common procurement questions.
Where does my tenant data live?
On your machine. File listings, job history, sync state, logs and settings live in local SQLite databases in your user profile. The IT Security & Deployment Guide, available on request, lists the exact locations and how to remove them. We do not maintain a copy. There is no cloud bucket. There is no analytics warehouse.
Does File Manager require an app registration in our tenant?
Not required. By default File Manager authenticates as Anadak’s multi-tenant public client; organizations that prefer to own the registration can point the app at their own by machine policy. Microsoft classifies the Graph scopes it requests at sign-in as user-consentable, so usually no admin step is needed; your tenant’s consent policy decides. If it restricts user consent, an admin approves once, and individual users then sign in normally.
Can our SIEM see what MungePoint does?
Yes. Every action MungePoint takes happens as the signed-in user via Microsoft Graph, so it appears in M365 unified audit logs and any SIEM ingesting that stream. There is no out-of-band channel to hide actions in.
What about insider risk, could MungePoint be misused?
It can only ever do what the signed-in user can already do manually. If a user wouldn’t have permission to delete a file via SharePoint UI, MungePoint can’t delete it either. The tool accelerates legitimate work; it doesn’t bypass tenant access controls.
Air-gapped or sovereign-cloud tenants?
Today MungePoint supports commercial (global) Microsoft 365 tenants only. Sovereign clouds (GCC High, DoD, China) are not supported. Pro also needs to reach the Anadak licensing service; contact us if your environment restricts outbound access.
What can a connected AI assistant do?
Only what File Manager offers it, as the signed-in user. On Free, an assistant on the same computer can search and list your libraries. With Pro, and with writes allowed, it can also download into a local workspace folder, create folders, rename, move, copy, recycle and upload. No tool permanently deletes content. Calls are recorded in a local audit log, and policy can turn the feature off or make it read-only.
Vulnerability disclosure?
Email [email protected] with “security” in the subject. Responsible-disclosure timelines are honored, we won’t threaten legal action against good-faith research.
Do you have a Trust Center?
This page is it. We don’t see the point of a separate Trust Center subdomain when the architecture is local-first; the page you’re reading is the disclosure surface. Will revisit if SOC 2 lands and a dedicated trust portal makes sense.
Walk into the procurement meeting prepared.
Download the app, try it on a test library, hand them this page.