Security
How WatchTower handles your configuration data
Collection is read-only, each organization’s data is kept separate, and every request from a person or an AI tool is checked against their role before any data is returned.
Controls
- Read-only collection
- Connectors request read permissions only. For Microsoft, those are Graph permissions such as Policy.Read.All and DeviceManagementConfiguration.Read.All, and the consent screen lists each one before you approve it.
- Separate data for each organization
- Each organization’s data is stored in its own database schema. Only its members, and partners it has granted access, can open it.
- Roles, two-factor, and SSO
- Roles control what each person can view and manage. Every account can use two-factor authentication, and Entra ID single sign-on is included in Professional and Enterprise.
- Sensitive values stay out of AI prompts
- Sensitive configuration values are encrypted at rest and masked before any data is sent to an AI model.
- MSP access you control
- You grant an MSP access, choose the highest role it can use, and can revoke it at any time. Each partner action is recorded against both the person and the partner. Partner access is an Enterprise feature.
AI tools get the same checks as people
The built-in assistant and external MCP clients reach WatchTower data only through tools, and every tool call goes through these four checks.
Identify the caller
The request must come from a signed-in user or a token issued to one.
Select the organization
The request is limited to one organization the user belongs to or has partner access to.
Check the tool permission
The user’s role must include the permission the tool requires.
Record the call
The tool call is logged with the user, the organization, and the tool name.