Take both at once
How well protected are you, and are you ready for AI? The two assessments share access and questionnaire, so you do the work once and get two reports.
Preview
Ordering opens soon
Some parts of the service are not translated yet, so ordering in English opens shortly. In the meantime, you are welcome to book 30 minutes with us.
Book 30 minutesThis is what the reports look like
This is the first page of a real report, as it looks. Your level, the score, and the three most urgent actions. The figures come from an anonymised run at a Norwegian organisation.
The excerpt is the first page of the Security Assessment report, taken from an anonymised run. The AI Readiness Assessment report has the same form and comes in addition. Your own report is based solely on measurements in your own environment.
Four steps. You do two of them.
Nils Martin Egge
Nils Martin heads the cyber department at Enora. He has broad experience in security as a CISO, consultant and head of the service area at Enora, with Microsoft 365 as his specialty. His philosophy is to make complex security understandable. The solution, the principles and the controls in this service are the result of exactly that.
What we get to see, and what we do not For IT
The access is read-only and is removed with one click in your own admin center. All activity is logged on your side.
| Area | What we use it for |
|---|---|
| Users and roles | Who has administrator rights, who lacks multi-factor authentication |
| Devices | Encryption, updates, support status |
| Inbox rules that forward, protection against phishing | |
| Sharing | What is shared with everyone, and with whom outside |
| Security alerts | Whether alerts are followed up, and how old the open ones are |
We never read the content of email, documents or files.
If IT chooses to grant extended access to email security, one permission in Microsoft's list is called «Manage Exchange As Application». The name is Microsoft's, and misleading. It lets our program connect to Exchange, and the role we get is Global Reader, which can only read. Attempts to change anything are rejected by Microsoft, not by us.Frequently asked questions
Why is it free? Because most people who see the report want help fixing what is urgent. That is the work we make our living from.
What if we are not an Enora customer? You do not need to be.
Can we withdraw the access? At any time, with one click on your side. It remains until you do, also after the report has been delivered.
What happens to the data? Raw data is deleted 14 days after delivery. The report is yours. The details are in the data processing agreement below.
Data processing agreement, version 1.4 Full text
Version 1.4, 10 October 2026. Applies to Security Assessment and AI Readiness Assessment. This English version is a translation of the Norwegian original. If the two versions differ, the Norwegian version prevails.
1. The parties
The organisation ordering the service, represented by the person who confirms the agreement when ordering, is the controller within the meaning of GDPR Article 4(7).
Enora AS, Norwegian organisation number 935 701 430, which performs the service on behalf of the ordering organisation, is the processor within the meaning of GDPR Article 4(8).
The agreement is entered into electronically when the order is placed. The person placing the order at the same time confirms that they are authorised to enter into the agreement on behalf of the organisation. Enora logs the agreement version, time, name and email address for the confirmation, and can produce this documentation on request.
2. Purpose, nature and duration of the processing
The purpose is to carry out a technical assessment of the controller's Microsoft 365 environment and to deliver a report with findings and recommendations.
The processing consists of:
- collection of settings and metadata using read access granted by the controller itself,
- automated assessment of this information against fixed control points,
- drafting of the report's text sections using a language model, see section 7,
- quality assurance by an adviser at Enora Cyber,
- delivery of the report to the controller.
The processing lasts from the time access is granted until the raw data and the report have been deleted in accordance with the time limits in section 9.
3. Categories of data subjects and personal data
Data subjects: the controller's employees and others with a user account in the controller's Microsoft 365 environment, including guest users, and the person who completes the questionnaire.
Categories of personal data:
- the user account's identifier (email address or username) and display name
- assigned roles, permissions and licences
- time, client type and country of sign-in
- information about devices linked to the account, for example device name, operating system, and encryption and update status
- configuration linked to the individual account, for example whether two-factor authentication is registered, rules for forwarding email, and consents granted to applications
- answers given in the questionnaire, including information the respondent chooses to provide in free text
- where the controller has chosen the leak check: information on whether an email address appears in publicly known data leaks, and which leaks
The content of email, documents and files is not processed. The access granted is read access to settings and metadata. Where the controller voluntarily uploads documentation, the content of the uploaded documents is processed.
Enora does not request, and has no need for, special categories of personal data under GDPR Article 9. The controller shall not provide such data in free-text fields or in uploaded documentation.
4. Instructions
Enora processes personal data only on documented instructions from the controller.
The controller gives Enora AS the following instruction: Enora collects, reads, compiles, assesses and otherwise processes personal data to the extent necessary to perform the agreed service and deliver the report, including the processing described in sections 2, 5, 6 and 7.
If Enora considers that an instruction infringes data protection law, Enora shall inform the controller without undue delay.
5. Optional additions
The following processing takes place only where the controller has actively chosen it when ordering. It is not ticked by default.
5.1 Ekstern kartlegging
Enora collects publicly available information about the domains registered in the controller's Microsoft 365 environment, and any domains the controller has provided: email protection settings in DNS, services that respond on the internet, known vulnerabilities registered in public indexes, subdomains registered in certificate logs, and information from the Central Coordinating Register for Legal Entities (Enhetsregisteret). Enora does not perform scans itself, does not log in and does not test vulnerabilities.
The information concerns domains, addresses and services, not individuals. Should personal data nevertheless occur, for example a name in a publicly registered entry, it is processed under this agreement.
5.2 Lekkasjesjekk
Enora checks whether employees' email addresses in Microsoft 365 appear in publicly known data leaks. The lookup is made against the Have I Been Pwned service.
The email addresses are sent to the service over an encrypted connection for the lookup. No passwords, names or other information are sent. The service is operated from Australia, see section 7 on transfers. A match means that the address appears in a leak that is already publicly known.
The purpose is to identify which of the organisation's accounts are exposed, so that passwords can be changed and two-factor authentication checked. The report shows the number and timing, and the administrator accounts affected, since these must be remedied immediately. The full list of affected accounts is provided to the controller on request.
If the leak check is not chosen, no information is sent to the service.
6. Confidentiality and restricted access
Access to the data is restricted to those Enora employees who need it in the course of their work to perform the service and to assist the controller with it.
Everyone who is given access is bound by a duty of confidentiality, covering both personal data and any other information that emerges from the assessment. The duty of confidentiality continues after the engagement has ended and after any employment with Enora has ceased.
7. Sub-processors and transfers outside the EEA
The controller gives Enora general written authorisation to engage sub-processors, cf. GDPR Article 28(2). Enora shall ensure that sub-processors are bound by the same obligations as those that follow from this agreement.
The following sub-processors are used in the service:
| Sub-processor | Purpose | Place of processing |
|---|---|---|
| Microsoft Ireland Operations Ltd. (Microsoft Azure) | Operation of the service, storage of collected data and reports | European Union, storage in Sweden |
| Microsoft Ireland Operations Ltd. (Azure AI Foundry) | Language model that drafts the report's text sections | May be processed outside the EEA, see below |
| Superlative Enterprises Pty Ltd (Have I Been Pwned) | Lookup against publicly known data leaks, only where the leak check is chosen | Australia |
Transfers outside the EEA. The report's text sections are drafted by a language model in Azure AI Foundry. The service uses the Global Standard deployment type, which means that an individual request may be processed in Microsoft data centres outside the EEA. The data is not stored by the model provider and is not used to train models.
Microsoft Corporation is certified under the EU-U.S. Data Privacy Framework. Where the processing takes place in the United States, the transfer is based on the Commission's adequacy decision for this framework. Where the processing takes place in a country outside the scope of the framework, the transfer is based on the EU standard contractual clauses (SCCs) as incorporated in Microsoft's data processing terms (Microsoft Products and Services Data Protection Addendum). Enora is working to limit the processing to data centres within the EU as soon as Microsoft makes this available for the model concerned.
Where the controller has chosen the leak check, email addresses are transferred to Have I Been Pwned in Australia. Australia is not covered by an adequacy decision, and the transfer is based on the EU standard contractual clauses in the provider's data processing agreement. Enora has carried out an assessment of the transfer (transfer impact assessment), see Annex B.
Enora shall notify the controller in writing at least 30 days before new sub-processors are engaged or replaced. The controller may object to the change in writing within that period.
8. Security of processing
Enora implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, cf. GDPR Article 32. The measures include:
- Access. Collection takes place with read access through an application that the controller itself approves, and that the controller can revoke at any time. The application has no write access.
- Storage. The data is stored encrypted in Microsoft Azure in Sweden, both in transit and at rest.
- Access control at Enora. Access is granted only to named employees through personal accounts with two-factor authentication, managed through groups and role-based access. Shared accounts are not used.
- Pseudonymisation. Identifiers are pseudonymised in the automated processing. Plain text is used only where the report must name the individual account for the controller to be able to remedy the finding, and in the internal overview of accounts affected by data leaks.
- Availability of the report. The report is available only to users in the controller's own Microsoft 365 environment, with an expiry date on the access. Every opening of the report is logged.
- Logging. Collection, assessment, changes made by an adviser and the sending of the report are logged with the time and who performed the action.
- Deletion. Automated deletion routines in accordance with the time limits in section 9.
9. Deletion and return
Raw data, meaning collected data, intermediate results and any documents the controller has uploaded, is deleted automatically 14 days after the report has been delivered.
The controller's access to the report lasts for 30 days from delivery. Enora may extend the access at the controller's request.
Enora's own copy of the report is kept for up to 6 months after delivery. The report contains some personal data, mainly the usernames of accounts affected by a finding. Keeping it is necessary to document what was delivered, to be able to answer questions from the controller about the findings, and to give further advice while the findings remain relevant. The report is then deleted automatically.
The controller may at any time request that the report be deleted earlier. Deletion then takes place within 30 days and is confirmed in writing.
After deletion, Enora retains no personal data from the engagement. Enora retains anonymous statistics as described in section 10.
10. Anonymous statistics
Enora compiles anonymous statistics from completed assessments in order to show the controller how the organisation compares with other organisations.
The statistics contain only the status per control point, that is, whether the control is in place, partly in place or missing, and the number of organisations behind each figure. They contain no organisation names, organisation numbers, reference numbers, personal data or text from the report, and cannot be traced back to the individual organisation or person. Comparison figures are shown only when at least five organisations are behind the figure.
As the statistics contain no personal data, they are not covered by the deletion obligation in section 9.
11. Assistance to the controller
11.1 Enora shall, insofar as this is possible, assist the controller in fulfilling its obligation to respond to requests from data subjects for the exercise of their rights under Chapter III of the GDPR. If a data subject contacts Enora directly, the request is forwarded to the controller without undue delay.
11.2 Enora shall assist the controller in complying with the obligations under GDPR Articles 32 to 36, taking into account the nature of the processing and the information available to Enora.
11.3 Enora shall make available to the controller all information necessary to demonstrate compliance with the obligations under GDPR Article 28, and shall allow for and contribute to audits conducted by the controller or an auditor mandated by the controller. The controller shall give at least 30 days' notice of such an audit. Enora's costs of an audit beyond ordinary documentation are borne by the controller.
12. Personal data breaches
Enora shall notify the controller in writing without undue delay of any personal data breach affecting the controller's data. The notification is sent as soon as Enora has a sufficient overview for it to give the controller a basis for action, and is supplemented as the matter is clarified.
The notification shall, as far as possible, describe the nature of the breach, the categories and approximate number of data subjects and personal data records concerned, the likely consequences, and the measures taken or proposed to be taken. Enora shall assist the controller with the information needed to assess notification to the Norwegian Data Protection Authority (Datatilsynet) and any communication to the data subjects.
Enora does not notify breaches to the Norwegian Data Protection Authority on behalf of the controller unless this has been specifically agreed.
13. Term and termination
The agreement applies for as long as Enora processes personal data on behalf of the controller in connection with the service.
On termination, the data is deleted in accordance with the time limits in section 9. The provisions on confidentiality in section 6 continue to apply after termination.
14. Relationship to Enora's standard terms
This agreement governs the processing of personal data. Other matters between the parties, including liability and limitation of liability, intellectual property rights, governing law and jurisdiction, are governed by Enora's standard terms. In the event of conflict between this agreement and the standard terms, this agreement prevails in matters concerning the processing of personal data.
Annex A: What is collected from Microsoft 365
The overview shows what information Enora collects, and at which access level. Level 1 is standard read access. Level 2 is extended access that the controller may choose in addition, and that can be revoked at any time.
| Area | What is collected | Personal data | Level |
|---|---|---|---|
| Organisation and licences | Tenant information, domains, purchased and assigned licences | No | 1 |
| Users and groups | User accounts, display names, roles, guests, groups, last sign-in | Yes | 1 |
| Authentication | Whether two-factor authentication is registered per account, methods in use, self-service password reset | Yes | 1 |
| Administrators | Role assignments, whether they are permanent or time-limited, activity | Yes | 1 |
| Conditional Access | Policies, state, exclusions | No | 1 |
| Devices | Registered and managed devices, operating system, encryption, update status, antivirus status | Yes, linked to the device and its owner | 1 |
| Applications | Registered apps, service principals, consents granted by users, expiring credentials | Yes, who granted the consent | 1 |
| Sharing and storage | SharePoint and OneDrive settings, sharing scope, public groups | No | 1 |
| Activity log | Extent of external and anonymous sharing over the last 90 days, sign-ins from unfamiliar countries | Yes | 1 |
| Inbox rules | Rules that forward, redirect or delete email | Yes, which account the rule belongs to | 1 |
| Security alerts | Alerts from Microsoft Defender and Entra ID Protection over the last 30 days, whether they are closed | Yes, where the alert concerns an account | 1 |
| Email protection in DNS | SPF, DKIM and DMARC for verified domains | No | 1 |
| Secure Score | Microsoft Secure Score and recommendations | No | 1 |
| Email security | Anti-phishing, Safe Links, Safe Attachments, transport rules, connectors, outbound spam, mailbox audit settings | Yes, where the setting concerns an account | 2 |
| Data protection | Sensitivity labels, DLP policies, retention policies | No | 2 |
| External mapping | Publicly available information about the domains registered in the controller's Microsoft 365 environment, and any domains the controller has provided: DNS, internet-facing services, subdomains in certificate logs, the Central Coordinating Register for Legal Entities | Yes | Yes |
| Leak check (optional) | Whether employees' email addresses appear in publicly known data leaks | Yes | Optional |
| Questionnaire | Answers from management on routines, responsibilities, preparedness and competence | Yes, where the respondent provides it | Optional |
The content of email, documents, files, chat and meetings is not collected at any level.
Annex B: Assessment of the transfer to Australia
The assessment of the transfer to Have I Been Pwned (transfer impact assessment) is provided as a separate document: “Assessment of transfer to a third country: Have I Been Pwned”, version 1.0. It summarises what is transferred, on what basis, how Australian law has been assessed, and which supplementary measures apply. The assessment is reviewed annually.