Your data never leaves your tenant
Fabric Control runs on operational metadata, not your data, and you control how much of that metadata you share. This page is written for the reviewer who has to sign off before you connect anything. The complete list of what crosses, item by item, is on the transparency page.
Your data stays in your tenant. Only metadata leaves.
The single most important property of Fabric Control: your data content never leaves your Azure tenant. To do its job, the system reads and reports only operational metadata about your environment, never the contents of it.
- No data content is ever transferred to us. Rows, records, and the contents of your tables and files stay inside your tenant, full stop.
- Only operational metadata is reported. Metadata describes your environment; it isn't the data in it. Fabric Control collects deliberately less than the platform's administrative APIs would let it.
- The boundary is built into the collection itself. No code path reads the contents of your tables, files or reports, so there's nothing to filter out afterward.
- Backups never leave either. When you enable Backup, your backups land in your own storage, under your own keys. Fabric Control coordinates the work but never holds a copy.
You decide how much metadata to share
Beyond the guarantee that your data never leaves, you also control the metadata that does. There's a small baseline the system needs to function, and above that, what you share is up to you. The full list, required and optional, is on the transparency page.
The required baseline
A minimal set of operational signals is essential: without it, the product simply can't govern, protect, or recover anything. This baseline is deliberately small and contains no data content.
- Operational metadata about the estate, nothing more
- Deliberately small: enough to govern, protect, and recover
- No data content, ever
Everything above it is optional
Richer metadata unlocks deeper insight, but it's your call. You choose how much detail to expose, and you can dial it back at any time. The deeper the picture you allow, the more Fabric Control can do for you.
- Share more for richer governance and reporting
- Share less to stay at the minimum footprint
- Change your mind whenever you like
The trade is simple and always in your hands: the more you share, the more the platform can tell you, but even at the minimum, your data content never leaves your tenant.
Nothing of yours changes hands. Remove it at any time.
No credential changes hands
The worker runs as a managed identity in your own subscription, created by the setup script, with no app registration and no client secret. There is nothing of yours for us to hold.
Remove it at any time
The grants and the worker are yours to remove, unilaterally, whenever you choose. Fabric Control never connects into your tenant; when the worker stops calling out, nothing is collected.
You control the access
The worker's grants are read-only. Every optional grant is shown in your portal with what it unlocks and what stays unread without it, and you can remove any of them at any time. Your data content never leaves your tenant.
Questions that usually take weeks have simple answers here
Because your data content never leaves your tenant and you control the metadata that does, the hardest questions in a vendor review are already answered.
"Where does our data go?"
Nowhere. Your data content stays inside your tenant, and your backups stay in your own storage, under your own keys. There's no data content to trace, because none is transferred.
"What if the vendor is breached?"
What we hold is operational metadata, never the contents of your environment. That metadata isn't nothing: it can be sensitive, which is why you control how much of it you share. But your data content and your backups stay in your tenant, so the exposure is bounded to the permitted metadata, not the data inside your estate.
What you can tell your reviewer
These are architectural facts about what does and doesn't move, not policies you have to take on trust:
- No data content is transferred to an external system, only operational metadata
- The metadata footprint is your choice, above a small required baseline
- Backups remain in your own storage, under your own keys
- The worker runs in your own subscription, read-only and outbound only; no inbound connection is ever required, and its grants are yours to remove at any time
- The complete list of what crosses is published, item by item, on the transparency page
PHI and compliance boundaries
Because your data content never leaves your tenant, and you control the metadata that does, the metadata-only design narrows the data-handling scope a regulated organization has to evaluate. Compliance itself depends on your environment, configuration and requirements; talk to us and we'll walk through exactly what is and isn't shared in your case.
Hand this page to your security team
Then join the beta: no card, no data leaving your boundary.