Privacy Statement

Last updated: 2026-07-21

We collect nothing

Mizan does not collect, transmit, or share any data about you or the firewall configuration you analyze — nothing is ever sent off your device. There is no account, no login, no analytics, no telemetry, and no cookies.

Your configuration file never leaves your device

When you drop a configuration file into Mizan, it is parsed and analyzed entirely inside your browser tab, using JavaScript that runs locally. The file is never uploaded to any server, not to Microsoft, not to us, not to any third party. You can verify this yourself: open your browser's developer tools to the Network tab before running an audit, and confirm no request completes successfully during the entire process. You may see one blocked (not completed) request to res.cdn.office.net — this is the bundled Microsoft Teams SDK attempting to refresh its own list of trusted Teams domains, which our Content-Security-Policy blocks before it can complete; the SDK immediately falls back to its own identical bundled domain list, and no data of any kind is sent.

What stays in your browser

The configuration you analyze is never written to storage. It is held in memory while the tab is open and discarded when you close it, so a reload starts from an empty audit. The findings, scores and any baseline you save are memory-only for the same reason.

Two things are saved in your browser's own local storage, on your device: your display preferences (theme, density, accent colour, last-viewed tab), and any risk acceptances you create, which are kept so they survive until the expiry date you set. A risk-acceptance record contains only your note, its expiry, and the date you accepted it; it is filed under a one-way digest of the finding's identity, computed with a random key generated once in your browser, so the device name, finding title and affected object names are not stored in readable form. No configuration text is stored. The note is free text you write yourself, so avoid pasting configuration or credentials into it.

All of this stays on your device — it is never uploaded and is not visible to us, Microsoft, or anyone else. You can erase it at any time by clearing this site's data in your browser.

Hosting is not the same as data collection

Mizan's static files (this page, the app tab, the manifest) are served from a web host so Microsoft Teams can load them. That is a hosting relationship for delivering code, not a channel through which your configuration data travels. The audit logic executes only in your browser, after the page has already loaded.

Contact

Questions about this statement can be raised through the app's Teams Store listing.