Built for the procurement questionnaire.

Hosting and data residency

Templ8r’s control plane runs entirely in Microsoft Azure datacentres in the UK and EU. No customer data, template binary, or generation log leaves these regions.

Identity & access control

Templ8r is a multi-tenant Microsoft Entra ID application. Sign-on is delegated to your existing identity provider — there is no separate Templ8r account, password, or username.

• →Admin-consent flow: a single grant by your Global Admin lights up Templ8r for the whole tenant. No per-user OAuth dance.
• →Customer-controlled app user inside Dataverse — pin the security roles, scope the entity coverage, revoke at any time.
• →JWTs are short-lived (15 minutes) and carry tenant_id, user_id, dataverse_url as signed claims. Every DB query and blob read is scoped by the tenant claim — cross-tenant access is impossible by construction.
• →Template visibility honours D365 security roles. A user only sees templates published to roles they hold.

In transit and at rest

One tenant cannot see another

Multi-tenant isolation isn’t a permission check we have to remember to write. The shape of the data layer rules it out.

• →Every persisted record carries tenant_id = your Dataverse OrganizationId. Every query filters on it.
• →Blob paths are prefixed {tenantId}/{blobId}. Managed-identity binding restricts the API’s effective permission to its own prefix.
• →The JWT claim is the single source of truth — it is signed server-side and not re-derivable from a request. A tampered client cannot widen its tenant scope.
• →There is no shared admin UI across tenants. Templ8r staff cannot enumerate customer data from a console — read access requires the same tenant-scoped flow.

What we log, how long we keep it

Who else touches your data

We use the minimum number of third parties needed to run the service. The list is short and stable.

Any change to this list is notified to active subscribers at least 30 days before the new sub-processor receives data. Mail security@templ8r.co.uk to be added to the change notice list.

What we have today, what we’re working towards

We are deliberately honest about the difference between certified and aligned.

If something goes wrong

We aim to notify affected tenant admins within 24 hours of confirming a security incident that may have affected their data. Notice includes scope, root cause, remediation steps, and a follow-up post-mortem inside 7 days.

Auditable by design

The Templ8r document-generation engine is open source. Procurement and your security team can read the binding compiler, the Dataverse fetch layer, and the merge pipeline directly — no NDA, no on-site visit.