Terms of Use.

These terms form an agreement between Avalon Web Services LLC (“Avalon”, “we”) and the organisation whose Microsoft 365 tenant is connected to the service (“you”). By granting admin consent to the Avalon CloudSec Graph application, or by using the service, you accept them.

Where you and Avalon have signed a separate written agreement covering this service, that agreement controls to the extent it conflicts with these terms.

The service exposes a fixed set of read-only tools that report the security posture of a Microsoft 365 tenant you have connected — MFA registration coverage, privileged role assignments, device compliance, Conditional Access policy state, Microsoft Secure Score and Defender XDR incident counts — to an AI assistant you operate.

The service reads. It does not write. It has no capability to change configuration, disable accounts, wipe devices, modify policies or resolve incidents in your tenant.

This matters more than the usual boilerplate, so it is stated plainly:

• It is not a compliance certification. Nothing the service reports establishes, demonstrates or certifies compliance with SOC 2, ISO 27001, HIPAA, CMMC, NIST or any other framework. Output may inform an assessment; it is not an assessment.
• It is not a replacement for Microsoft's own tooling. It is a reporting layer over Microsoft Graph. Microsoft Defender, Entra ID Protection, Intune and Purview remain the systems of record, and the place to act.
• It is not monitoring. The service answers questions when asked. It does not watch your tenant, does not alert, and will not tell you when something changes.
• Figures can be incomplete, and say so. Where a Microsoft licence or permission is absent, or a large collection is truncated, results are marked partial and carry a warning. Treat a zero in a partial result as “not available”, never as “none found”.

Verify any finding in the relevant Microsoft portal before acting on it.

• Granting and maintaining admin consent for the tenants you want covered, and revoking it when you no longer do.
• Holding the Microsoft licences that the underlying data requires — Entra ID P1 or P2, Intune, Defender XDR as applicable.
• Deciding who in your organisation may query which tenants, and telling us promptly when that should change.
• The AI assistant you connect, your agreement with its provider, and what that assistant does with data the service returns.
• Using the service in line with our acceptable use policy.

We target 99.5% monthly availability of the service endpoint, measured excluding downtime in Microsoft services the platform depends on, and excluding scheduled maintenance notified in advance.

This is an operational target, not a service level agreement. Where a signed agreement between you and Avalon sets a contractual service level and a remedy for missing it, that agreement governs. These terms on their own create no service credit or other remedy.

The privacy notice for this service describes what is accessed, what is retained, for how long, and what is never stored. It forms part of these terms.

In summary: we do not retain the security data the service returns, we do not retain prompts or tokens, and no AI model operated by us or by a third party on our behalf receives your security telemetry.

Fees, billing period, payment terms and price-change notice are as set out in your order form or subscription confirmation. We do not publish pricing on this page; ask and we will send current pricing for the tier that fits how you operate.

These terms apply from the moment you first connect a tenant until the subscription ends or consent is revoked.

You may end access at any time by revoking the application in your own tenant. That takes effect immediately and requires nothing from us.

Subscriptions run month to month with no minimum term. Cancelling stops the next billing period; fees already paid for the current month are not refunded. Where your order form sets a different term, the order form governs.

We may suspend access where use breaches the acceptable use policy, where we are required to by law, or where continued operation would put your tenant or ours at risk — with notice wherever it is safe to give it.

The service is provided as described in our documentation. We do not warrant that it will be uninterrupted or error-free, and we do not warrant the completeness or accuracy of data sourced from Microsoft Graph. The service reports what Microsoft returns, including where a tenant’s licensing limits what that is.

All other warranties, and any jurisdiction-specific disclaimers, are as set out in the signed agreement between you and Avalon.

Limits of liability, the cap on it, and the categories of loss excluded are set out in the signed agreement between you and Avalon. They are deliberately not restated here: a cap means something only when it is set against actual fees, the customer profile and the insurance in place, and that is a negotiation rather than a web page.

If you are evaluating the service and need to read those terms before connecting a tenant, ask and we will send the current form of agreement.

We will give the administrative contact for each customer at least 30 days’ notice of material changes. Continued use after they take effect is acceptance. The date at the top of this page reflects the current version.

Where you and Avalon have signed an agreement covering this service, the governing law and venue clause in that agreement controls. Absent one, these terms are governed by the laws of the State of Texas, without regard to its conflict-of-law rules, and the state and federal courts sitting in that state have exclusive jurisdiction.

Questions about these terms? Email support@awservices.org. Security concerns and vulnerability reports go to security@awservices.org.