How ModernSync handles your Microsoft 365 data

In short

• Data: We don’t keep the contact cards. They are only read and written during a run. We store the setup, overviews and logs, plus names from the add-ons you switch on yourself.
• Access: Each app only has the permissions it needs, and ModernSync only changes its own contacts. You can always remove access in your Entra ID.
• No secrets: ModernSync uses Microsoft managed identity and has no stored passwords or keys. The data we store is encrypted.
• Where and who: Microsoft Azure in the EU (Sweden). Microsoft is our only subprocessor. ModernTech and any MSP partner your organisation is associated with have access.
• When you stop: You can download your data yourself in the portal. We delete your setup, activity log and run history 90 days after offboarding.

These are the design choices that limit what ModernSync can see and change in your tenant. GDPR calls this data protection by design (Article 25).

What we store

• We don’t keep the contact cards. ModernSync reads the contacts in your Microsoft 365 and writes them to employees’ mailboxes during a run. They are not kept with us afterwards.
• What we do store is your setup, a mailbox overview with the recipients’ name and email, and the logs listed below.
• Two add-ons store names, and only your own administrator can switch them on. The check for outdated contacts reads name, email and numbers on users’ own contacts without changing them and stores only the names for findings. Run details store names and field names, not values, for the latest test run and run for at most 30 days. They are shown only to your own administrators and are not included in the backup. What an add-on stored is deleted when it is switched off.

Annex A of the data processing agreement lists this exactly.

Access to your Microsoft 365

• Only the access needed. The contacts app can’t read email, calendars or files. The Microsoft permission for contacts covers all mailboxes in the organisation, but ModernSync writes only to the mailboxes of the recipient group and only to its own contacts. With Include external contacts, the contacts app also reads the external contacts in your address book with the permission OrgContact.Read.All, which can only read.
• The calendar add-on is a second app that you approve on its own. It reads the calendar of the shared mailbox you choose and writes only to calendars it created itself.
• You control access. You see the permissions on Microsoft’s page before you approve. When you remove the app in Entra ID, Microsoft stops issuing access tokens to it. A run that is already in progress can continue for up to an hour.
• Only a global administrator or an Exchange administrator in your organisation can choose a mailbox as a source.

Protection against mistakes

• Only changes its own contacts. Every contact ModernSync creates gets a hidden tag, and it only changes contacts with that tag. The exception is Adopt existing contacts, which you turn on yourself: ModernSync then takes over only contacts without notes, private numbers or several email addresses. When the contacts stop, the contacts taken over stay without our marker. They are deleted only when the person is no longer in the group or contact folder the contacts come from, for example because the colleague has left or has been removed from the group.
• Test run first. A test run shows what ModernSync would change without writing anything. A safeguard stops any run that would delete an unusual number of contacts.

Sign-in, secrets and encryption

• No stored passwords or keys. ModernSync uses Microsoft managed identity. The app you approve has no certificate and no password.
• Your own security rules apply. Your administrators sign in with their own Microsoft account.
• Customers are separated. Each customer can only see and change its own setup.
• Encryption. Data is encrypted in transit and at rest.

Who at ModernTech can see your data

• ModernTech and any MSP partner your organisation is associated with have access. In the portal, only named accounts at ModernTech can see all customers. The accounts are on a fixed list that can only be changed with a code change and a new deployment.
• With that access we can see your setup, mailbox overview and runs, extend a trial, pause ModernSync and offboard you. We cannot accept terms or choose a subscription for you.
• When we open your data, it is recorded in the activity log with our object ID.

What we log, and for how long

Log	Content	Kept for
Technical logs (Azure Application Insights)	Time, organisation, status and error messages. An error message can contain an email address or an object ID	30 days
Activity log	Who (object ID), when, which call and the names of the fields that changed, not the content. You can see it in the portal	12 months
Run history	Time, status and number of contacts per rule. Email addresses in error messages are masked	12 months
Backup	Your setup and the month’s usage, no contacts	30 days

Once you have offboarded, your setup, activity log and run history are deleted 90 days later. Annex A of the Data Processing Agreement has the full list.

Where data is, and who processes it

Subprocessor	What	Where
Microsoft Ireland Operations Limited	Hosting in Microsoft Azure, sign-in with Entra ID and sending alerts from Microsoft 365	Azure in Sweden (the Sweden Central region). Sign-in and sending of alerts in the EU

• The list is the same as Annex B of the Data Processing Agreement. We let you know before we start using a new subprocessor (section 5 of the Data Processing Agreement).
• When you sign up, we look up your VAT number in the European Commission’s VIES register. The Commission is a public authority, not a subprocessor.
• ModernSync is run by Moderntech Consulting ApS in Denmark and follows Danish and EU law.
• Microsoft is part of a US group and may be asked to hand over data under US law. In its data protection terms, Microsoft has committed to reject or challenge such requests where there is no valid basis, and to notify customers where the law allows.
• We don’t keep the contact cards, so they can’t be handed over by us. We don’t hand data to authorities outside the EU unless EU or Danish law provides a basis for it.

Handing over data when you switch

The contacts and calendars are in your own Microsoft 365 and need no handover. You can download what we store yourself, free of charge, in the portal under Settings → Download your data. The list of what you can download, and in which format, is Annex 1 of the Terms, and it is part of the agreement.

When you stop, or if ModernSync closes

• When you offboard, you choose whether ModernSync removes its contacts or keeps them without updates. If a trial ends without you choosing a subscription, ModernSync removes its contacts and calendars.
• There is no separate arrangement for ModernSync closing. From how it is built and from the agreements: the contacts and calendars stay in your own Microsoft 365 but are no longer updated. You can download what we keep as long as the portal is running, and remove the app in your Entra ID. We can end the agreement with 1 month’s notice (section 5 of the Terms) and then delete the data we have processed for you (section 9 of the Data Processing Agreement).

What we don’t do

• We don’t sell data or use it for marketing.
• The portal uses no tracking cookies.

Vulnerabilities

If you have found a vulnerability, write to privacy@modernsync.io.

Read more

Terms · Data Processing Agreement · Privacy Policy

This page describes how ModernSync is built today. What we have committed to is in the terms (with Annex 1) and the data processing agreement.