1. What is open, and under what licence
We publish Microsoft 365 Governance as Code as open source, under the MIT Licence. The licence text travels with the code and it is short enough to read in a minute. It grants you the right to use, copy, modify, merge, publish, distribute, sublicense and sell the software, on one condition: the copyright notice and the licence go with it.
It also states, in the same breath, that the software comes “as is”, without warranty of any kind. That is not a formality we bolted on. It is the deal: you get the whole thing, you can read every line, and nobody is promising you it is fit for what you are about to do with it. If it matters, read the rules and the evidence before you act on the output: the product is built so that you can.
The source is at github.com/ph7x-Systems/m365-governance-as-code.
2. Components we did not write
The software depends on other people's open-source work, and each piece keeps its own licence. Those licences travel with the packages you install, and they are the ones that apply to that code: not ours.
The website also uses third-party components, and where a licence requires attribution we give it. If you find something we publish whose licence we have got wrong, write to us and we will correct it.
3. We never ask for your credentials
This is worth stating plainly, because it is the thing an attacker would want to imitate.
Running our software never requires you to give tenant credentials to pH7x Systems. It runs on your machine. Authentication and authorisation happen between you and Microsoft, using an identity you create and permissions you grant. There is no account with us, no sign-in, no licence key that phones home.
If anything asks you to hand over credentials, secrets or certificates to pH7x Systems in order to use this software, it is not from us. Please tell us about it.
4. Reporting a vulnerability
If you find a security problem in the software or on this website, write to support@ph7x.com. Tell us what you ran, what happened, and what you expected instead. Please give us a reasonable opportunity to fix it before publishing the details.
We will confirm we received your report, tell you what we found, and credit you when the fix ships if you want to be credited. We do not run a paid bounty programme.
5. What the software does on a network
It authenticates against, and reads from, Microsoft's own service endpoints, using the identity you configure. That is the whole of it. There is no telemetry, no usage reporting, and no licence check.
Tenant evidence processed by the software is not sent to pH7x Systems by the software. What it produces is written to your disk, and stays there unless you decide otherwise. Note that this is a statement about the software: this website is a different thing, and the Privacy Policy says exactly what it collects.
6. Contributing
Contributions are welcome through the repository. By opening a pull request you offer your contribution under the same MIT Licence the project uses. We review what comes in, and we may decline a contribution without that being a judgement on it.
7. Trademarks
The MIT Licence covers copyright. It does not grant rights to our name or marks: pH7x Systems® and our logo remain ours, and a fork may not present itself as us. Microsoft 365, Microsoft Graph, SharePoint, Entra ID and PnP belong to their respective owners; pH7x Systems is not Microsoft and is not affiliated with, or endorsed by, Microsoft.
Governing language
This document is provided in several languages for your convenience. In the event of any divergence or conflict of interpretation between the versions, the Portuguese version shall prevail.