Security Statement

Client-side-only architecture

Mizan has no backend, no database, and no server-side processing of configuration data. The app is a static bundle (HTML/CSS/JS) served to your browser; every parsing step and every security check executes locally, inside the Teams tab, using only the JavaScript already downloaded to your machine.

No telemetry, no analytics, no cookies

Nothing about your usage, your device, or the configuration you upload is recorded or sent anywhere. The app does not set cookies and does not call any analytics or logging service.

Your configuration is never stored

The configuration you analyse is held in memory for as long as the tab is open and is discarded when you close it. It is never written to browser storage, so closing the tab or reloading the page leaves no configuration behind and starts from an empty audit. Findings, scores and any baseline you save during a session are memory-only for the same reason.

Two things do persist in your browser's local storage, on your device only:

Display preferences — theme, density, accent colour and the tab you last had open. These contain nothing about your network.
Risk acceptances — if you accept a finding, the acceptance is saved so it survives until its expiry date. The record itself contains only your note, the expiry date and the date you accepted it. It is filed under a one-way digest of the finding's identity (device name, finding title, affected object names), computed with a random key generated once in your browser, so none of those names is stored in readable form and the digest cannot be worked backwards by someone reading your browser storage. The note is free text that you write, so please do not paste configuration, credentials or addresses into it. Clearing this site's data in your browser erases all of it.

Teams-only is a usage restriction, not a security control

Mizan is intended to be used inside Microsoft Teams, and the tool will not load if its URL is opened directly in an ordinary browser tab. We want to be precise about what that does and does not mean: this restriction is enforced by a marker in the tab URL and a check on how the browser requested the page. Both are ordinary, client-controllable signals. They are enough to stop the tool being opened casually outside Teams, and they are not authentication, not identity verification, and not a security boundary. Mizan requests no sign-in and holds no user account, so there is no identity for it to check. Treat the tool as unauthenticated software that runs entirely on your own machine, and rely on your device and Teams tenant controls for access management.

Inside Microsoft Teams

The Teams SDK (@microsoft/teams-js) is used only for the app's initialization handshake and to read Teams' current light/dark/contrast theme so the tab's appearance matches the rest of Teams. No identity, authentication, or messaging APIs are used, and the app requests no permissions.

The bundled Teams SDK may attempt one outbound request on load to refresh Microsoft's list of trusted Teams domains. Our Content-Security-Policy blocks this at the browser level before it can complete, and the SDK immediately falls back to its own identical bundled domain list — no data is sent, and functionality is unaffected. If you inspect the Network tab, you may see this single blocked (not completed) request; it never leaves the browser with any data.

Known limitation: administrator passwords in firewall configuration exports are stored as cryptographic hashes (e.g. SHA-256/PBKDF2), not plaintext. Mizan cannot and does not attempt to test password strength or crack these hashes. It only flags genuinely plaintext credentials found in a configuration, and says so explicitly in the report.

Verifying these claims

Open your browser's developer tools to the Network tab before dropping in a configuration file, and confirm that no request fires at any point during parsing, analysis, or report generation.

For completeness, the page itself does make one request when it first loads: a web-font stylesheet from Google Fonts, used purely for typography. It carries no configuration data and no information about you beyond what any browser sends when fetching a stylesheet. It happens once, on load, before you have selected a file. We are moving to a self-hosted font so that the page makes no external request at all.