Software we build for problems we kept meeting.

Backs up your configuration every night

Around 300 settings across Entra ID, Intune, Microsoft 365 and Defender, Exchange Online, Teams, Purview, SharePoint, Azure and Microsoft Sentinel, saved as dated snapshots with one readable file per object.

Shows you what changed, never the values

A change report after every run lists the objects added, removed or changed and which properties moved, without exposing the settings themselves, so it is safe to e-mail and safe to review.

Restores with a dry run first

Choose the latest good copy, a moment in time, one workload or one policy. Only what drifted or was deleted is touched, nothing is ever deleted, and the current state is saved before anything is applied.

Keeps copies outside the machine that makes them

Each snapshot is encrypted (AES-256-GCM) and sent to storage in your own Azure subscription, with versioning and soft delete, so earlier copies survive accidental or malicious deletion for the retention period you set (30 days by default).

Read-only by design

The scheduled identity signs in with a certificate and holds no write permission. Anything that can change the tenant is a separate application or an administrator signing in for that task.

Tells you when a night is missed

A summary e-mail follows every run, and an alert inside Azure fires if no backup copy has reached your storage for 26 hours, whatever the cause.

Lets you rehearse recovery

Ready-made restore drills create a harmless test object, restore it and remove it, so you can prove the process in your own tenant before you need it.

Rebuilds after losing the host

The toolkit itself is copied, encrypted, to the same storage, so a replacement machine can be brought back from the copy and your passphrase.

Discovery of shadow AI

Identify model providers, assistants, browser extensions and embedded AI features in use across the estate, mapped to the teams using them.

Policy at the point of use

Allow, warn or block specific models, features and data classes before a prompt leaves the device, rather than after it reaches a provider.

Data loss prevention for prompts

Detect and redact or withhold regulated, contractual and intellectual property content in prompts, attachments and agent tool calls.

Agent and automation controls

Scope what autonomous workflows may read, write and call, with approvals required for actions that touch production systems or customer data.

Vendor and model assurance

Track where model providers process and retain data, their training use, and your contractual position, so approvals rest on evidence rather than a sales deck.

Immutable audit trail

Prompt, response, model, user, purpose and policy decision recorded together, exportable for regulators, customers and internal review.

Risk and cost visibility

Usage, exposure and spend by team, model and use case, so governance effort and budget follow what is actually happening.

Aligned to existing frameworks

Controls mapped to ISO/IEC 42001, NIST AI Risk Management Framework, and the EU AI Act obligations your organisation already reports against.