Your data never leaves your tenant
Fabric Control runs on operational metadata, not your data, and you control how much of that metadata you share. This page is written for the reviewer who has to sign off before you connect anything.
Your data stays in your tenant. Only metadata leaves.
The single most important property of Fabric Control: your data content never leaves your Azure tenant. To do its job, the system reads and reports only operational metadata about your environment, never the contents of it.
- No data content is ever transferred to us. Rows, records, and the contents of your tables and files stay inside your tenant, full stop.
- Only operational metadata is reported. Metadata describes your environment; it isn't the data in it. Fabric Control collects deliberately less than the platform's administrative APIs would let it.
- The boundary is built into the collection itself. No code path reads the contents of your tables, files or reports, so there's nothing to filter out afterward.
- Backups never leave either. When you enable Backup, your backups land in your own storage, under your own keys. Fabric Control coordinates the work but never holds a copy.
You decide how much metadata to share
Beyond the guarantee that your data never leaves, you also control the metadata that does. There's a small baseline the system needs to function, and above that, what you share is up to you.
The required baseline
A minimal set of operational signals is essential: without it, the product simply can't govern, protect, or recover anything. This baseline is deliberately small and contains no data content.
- Operational metadata about the estate, nothing more
- Deliberately small: enough to govern, protect, and recover
- No data content, ever
Everything above it is optional
Richer metadata unlocks deeper insight, but it's your call. You choose how much detail to expose, and you can dial it back at any time. The deeper the picture you allow, the more Fabric Control can do for you.
- Share more for richer governance and reporting
- Share less to stay at the minimum footprint
- Change your mind whenever you like
The trade is simple and always in your hands: the more you share, the more the platform can tell you, but even at the minimum, your data content never leaves your tenant.
You grant access. You revoke it. At any time.
Client-held credentials
You provision access to Fabric Control using credentials you own and control. We never hold master keys to your environment.
Revoke at any time
Revoking access is yours to do, unilaterally, whenever you choose. Once the revocation takes effect, Fabric Control can no longer reach your tenant.
You control the access
Fabric Control operates on operational metadata. Your data content never leaves your tenant. You grant the access it needs, and you can revoke it at any time.
Questions that usually take weeks have simple answers here
Because your data content never leaves your tenant and you control the metadata that does, the hardest questions in a vendor review are already answered.
"Where does our data go?"
Nowhere. Your data content stays inside your tenant, and your backups stay in your own storage, under your own keys. There's no data content to trace, because none is transferred.
"What if the vendor is breached?"
What we hold is operational metadata, never the contents of your environment. That metadata isn't nothing: it can be sensitive, which is why you control how much of it you share. But your data content and your backups stay in your tenant, so the exposure is bounded to the permitted metadata, not the data inside your estate.
What you can tell your reviewer
These are architectural facts about what does and doesn't move, not policies you have to take on trust:
- No data content is transferred to an external system, only operational metadata
- The metadata footprint is your choice, above a small required baseline
- Backups remain in your own storage, under your own keys
- Access is granted by you and revocable by you, at any time
PHI and compliance boundaries
Because your data content never leaves your tenant, and you control the metadata that does, the metadata-only design narrows the data-handling scope a regulated organization has to evaluate. Compliance itself depends on your environment, configuration and requirements; talk to us and we'll walk through exactly what is and isn't shared in your case.
Hand this page to your security team
Then join the beta: no card, no data leaving your boundary.