Security & Privacy
We designed Tenant Launcher around one principle: if we don't have it, we can't leak it. Your Microsoft credentials never touch our servers. Your client sessions never leave your browser.
What we never collect
There's no password field anywhere in the extension or desktop app. We built it this way intentionally.
We never ask for, store, or transmit your Microsoft 365 passwords. Sign-in happens directly on Microsoft's own pages.
Authentication tokens stay inside your browser, bound to each tenant's isolated container or browser profile. They never reach our servers.
We have no visibility into your Microsoft sessions. We can't see what you're doing inside admin portals — and we designed it that way.
What we actually store
Here's every piece of data we store and exactly where it lives.
Session isolation
The core security guarantee: opening Contoso's admin portal can never affect Fabrikam's session. Here's how that works.
Each tenant gets a dedicated Firefox container. Containers are completely isolated — separate cookies, separate sessions, separate storage. This is Firefox's own native isolation system, not a workaround.
Each tenant gets its own fully separate browser instance (--user-data-dir) keyed by an immutable ID. Sessions can't bleed between tenants. Unlinking or deleting a tenant wipes its local browser data. The app launches your installed browser — it never reads cookies, tokens, or anything inside those profiles.
Edge tenant portals render inside the app's own window, in a dedicated, persistent session per tenant, instead of launching your system copy of Edge. This is intentional: Windows' own account sign-in system (Web Account Manager) can silently sign a real Edge browser profile into your personal or work Microsoft account, even a brand-new isolated one — a platform behavior outside any app's control. Rendering Edge portals in the app's own embedded browser engine avoids that entirely, while still keeping each tenant's session separate and persistent. The one exception to "never reads cookies or tokens": for Edge only, the app checks whether a Microsoft sign-in cookie is present and unexpired in that tenant's session, solely so the "Linked" status in the tenant list is accurate instead of just "a profile was created here at some point." It reads only that cookie's name and expiry — never its value, and never any other cookie, token, or data in the session. Chrome and Brave aren't checked this way at all, since those run as a completely separate browser process the app has no access into.
One click in Tenant Launcher
Completely separate session for that tenant
Sign in once, stay signed in — always to the right tenant
Infrastructure
We don't run our own database servers. We use established, SOC 2 compliant infrastructure.
All tenant data and account information is stored in Supabase — an open-source Firebase alternative built on PostgreSQL. Data is encrypted at rest and in transit. Row-level security policies ensure users can only access their own data.
All billing is handled by Stripe — a PCI DSS Level 1 certified payment processor. We never see or store your card details. Payment information goes directly to Stripe.
All communication between the extension, desktop app, and our backend uses HTTPS/TLS. No data is ever transmitted in plain text.
Desktop App — Technical Detail
For Chrome, Edge, and Brave users. Every security decision is intentional.
The app never handles customer tenant credentials at any point. Techs sign into Microsoft directly on Microsoft's own login page — either inside their own copy of Chrome or Brave (for those two, the app just launches the browser pointed at the right isolated profile, and never reads anything inside it), or inside the app's own embedded, sandboxed session for Edge. For Edge only, the app checks for the presence and expiry of a Microsoft sign-in cookie — never its value — purely to show accurate link status; see the isolation section above for exactly what that does and doesn't involve.
For Chrome and Brave, sessions live in that browser's own profile storage, encrypted by Chromium using OS-level protection — DPAPI on Windows (tied to your Windows user account), Keychain on macOS — the same protection your browser uses for saved passwords. For Edge, sessions live in the app's own local storage, using the same underlying Chromium engine and encryption primitives, kept separate per tenant. We never touch that storage.
After sign-in, your Supabase session token is encrypted using Electron's safeStorage before touching disk — DPAPI on Windows, Keychain on macOS. Not a key baked into the app — actual OS-level encryption tied to your user account. Your password is sent over TLS to Supabase Auth and never written anywhere.
If you attach an IT Glue or password vault link to a tenant, we store only the URL string. We never fetch, crawl, or read what's behind it. Clicking it opens your browser — whatever authentication your vault requires happens there, entirely outside Tenant Launcher.
Manage Tenants includes an "Unlink" action (single or bulk) that resets a tenant's isolated session back to signed-out on demand. Deleting a tenant does the same automatically. Either way, its browser profile (Chrome/Brave) or in-app session (Edge) — cookies, sessions, cached data, all of it — is removed from your machine. Nothing lingers. This works across Chrome, Edge, and Brave.
Per tenant we store exactly: a display name, a SharePoint domain prefix, an optional vault URL, and a sort order. No customer credentials, no customer data, nothing from inside the tenant. In transit it's TLS to Supabase — at rest it's scoped per-account by row-level security.
Enterprise
Enterprise accounts get a complete activity log — every portal access recorded for accountability and compliance reporting.
Access control
Enterprise accounts give the company owner full control over who can access what.
Invite technicians by email. They receive a secure invitation link and set their own password — you never share credentials.
Each technician uses their own Tenant Launcher account. Access is tied to your company subscription — not shared passwords or shared accounts.
Remove a technician from your team dashboard and their seat is freed immediately — they're dropped from your team and lose Enterprise access.
Join MSPs who use Tenant Launcher to manage their clients securely. Free to start — no card required.