EAMP · Security and data
How EAMP is built, and what happens to your data.
A platform that decides which software may run in your organisation has to be demonstrably trustworthy itself. This is how it works.
Architecture
Your tenant, our platform, and what flows in between.
Administrators work in the portal; devices talk to the API through the EAMP agent. Everything EAMP sends to a device is signed. Intune optionally remains the deployment channel.
Your Microsoft tenant
What flows
- Portal and API: HTTPS with the administrator’s Entra token
- Agent: signed policies to the device, attestations back
- Microsoft Graph: read devices and group membership
- Optional: deploy policies and apps through Intune
EAMP · Azure West Europe
Data
Which data, where, and for how long.
- Location
- Microsoft Azure, West Europe region (the Netherlands).
- Policies and templates
- Drafts, approvals and signed versions, stored separately per tenant.
- Device data
- Device ID from Entra ID, applied policy versions, attestations and data on blocked files (such as name, hash and signer), deduplicated per device. No file contents and no process context.
- Installers
- Uploaded installers are deleted after 2 days, conversion results and logs after 14 days.
- Passwords and keys
- EAMP never sees passwords and stores no sign-in credentials for your tenant. Signing keys are kept in Azure Key Vault.
Tenant isolation
Separated per customer, down to the package.
- Every customer has its own storage containers, and every table partition starts with the tenant ID.
- Tenant and device are always taken from validated tokens, never from what a request claims about itself.
- A package bound to tenant A refuses tenant B’s policies.
- Access runs through three Entra app registrations that your administrator consents to, and roles you assign yourself.
Operations
How we run the platform.
- Agent updates through a signed update channel; the policy runtime is pinned per version and checked by hash.
- Every policy that reaches a device is signed and verified before it is read.
- Automated tests and contract tests on every change, and a four-eyes process for publishing.
- We document known limitations openly, and share them during onboarding.
Integrations
Works with what you already have.
Microsoft Entra ID
Sign-in for administrators, device identity, and group membership for targeting policies.
Microsoft Intune
Optional deployment channel for App Control policies and MSIX apps.
Azure Artifact Signing
Signing of policies and packages, through our platform or with your own account.
Windows
App Control for Business (CiTool), MSIX and App Attach, on Windows 10, Windows 11 and Windows Server.
Onboarding
Connected in about half an hour.
Consent
A Global Administrator consents once to the three EAMP app registrations.
Roles
You assign the roles: Author creates, Approver approves (four eyes), Admin manages the settings.
Register the tenant
You register your tenant in the portal and choose the deployment channel.
Start in audit
The first devices get the agent and run in audit mode: watch first, enforce later.
Questions about security or data?
We’re happy to walk your security team through the architecture, with the documentation at hand.