Security you can explain to your IT team
How sign-in works, where your data and documents live, and what CLNG can and cannot do.
Sign-in and access
- Microsoft Entra single sign-on. People sign in with their own Microsoft 365 accounts, brokered by Auth0 using the OAuth 2.0 and OpenID Connect standards. CLNG does not store user passwords.
- Your multi-factor policies apply. Multi-factor authentication and conditional access are whatever your organization enforces in Microsoft Entra.
- Invitation-only. People join your CLNG organization by invitation, with roles assigned at invitation. Someone who has not been invited is denied, even with a valid Microsoft 365 account. Invitations and active users count against your seat limit, and an invitation expires if it is not accepted.
- Roles. Each person's roles are assigned when you invite them. Administrators can revoke a person's access at any time.
Tenant isolation
Each customer is tied to its own Microsoft Entra directory. A sign-in is refused if the person's directory does not match the customer's, and the service checks the match again as a second gate. Records are tagged with their customer and isolated in the application and in the database itself, where row-level security fails closed: if a request is not tied to a customer, it returns nothing.
Your documents stay in your Microsoft 365
Matter documents are stored in your own Microsoft 365 tenant, in one SharePoint Embedded container per matter. The containers have no site or library address and are hidden from SharePoint, OneDrive, Teams, office.com and Microsoft 365 Copilot, so there is no back door around CLNG's permissions.
A person reaches a document only by asking CLNG to open it. CLNG checks their permission at that moment, then issues a personal link that works only for them and expires within about a working day. Search runs as the signed-in user and is filtered by CLNG's permissions again before anything is shown.
CLNG holds two narrow application permissions, both limited to the containers it owns. Email and calendar access acts as the signed-in user, and CLNG does not send mail on your behalf. Before you consent, we walk your IT team through every permission and what it is for. A Global Administrator then approves CLNG from a setup link, and your CLNG administrator finishes document storage setup inside CLNG. Your Microsoft Purview retention, legal hold, eDiscovery and audit apply to the documents.
Audit trails
CLNG keeps audit records of user administration, such as invitations, role changes and revocations, and of document opens and changes.
What CLNG does not do
We would rather you hear limits from us than find them later. Sign-in is through Microsoft Entra only, so other identity providers are not supported. Microsoft 365 GCC High and DoD tenants are not supported, and neither is Azure for Government. Offices without Microsoft 365 are not supported yet.
Security questions we hear
Is single sign-on supported?
Yes. CLNG uses Microsoft Entra single sign-on, so people sign in with their own Microsoft 365 accounts. Other identity providers are not currently supported.
How is multi-factor authentication handled?
Multi-factor authentication and conditional access follow the policies your organization sets in Microsoft Entra. CLNG does not keep a separate set of passwords. During onboarding we check your conditional access policies for compatibility.
What does our IT team need to do?
A Microsoft 365 Global Administrator approves CLNG once from a setup link, which takes about five minutes. Your CLNG administrator then finishes document storage setup in CLNG, where CLNG creates a private Microsoft 365 group for your office or adopts one your IT team has made, and we guide your IT team through the rest of onboarding. Every user needs a Microsoft 365 account with a mailbox and SharePoint and Office for the web licensing.
What permissions does CLNG hold in our tenant?
Two application permissions, both limited to the document containers CLNG itself owns: one to create and manage those containers, and one to register the container type once. Separately, when people sign in, they consent to permissions that act as the signed-in user, including access to their own files, mail and calendar and to Microsoft 365 groups. Microsoft describes the group permission on the consent screen as read and write for all groups, and CLNG uses it to keep your office's CLNG group in sync. Acting as the user, CLNG never goes beyond that user's own rights. CLNG does not send email on your behalf. We walk your IT team through each permission and what it is for, before you consent.
Can our documents be found through SharePoint, OneDrive, Teams or Copilot?
No. Documents are stored in SharePoint Embedded containers that have no site or library address, and they are hidden from SharePoint, OneDrive, Teams, office.com and Microsoft 365 Copilot, even for people who have access to them in CLNG. People reach a document only by asking CLNG to open it.
Do our Microsoft retention, legal-hold and audit policies apply?
Yes. Microsoft Purview retention, legal hold, eDiscovery and audit apply to CLNG documents like any other Microsoft 365 content. CLNG also writes its own audit record of document opens and changes.
Can we change our tenant sharing settings?
Yes, but please tell us first. Each time someone opens a document, CLNG uses a Microsoft sharing grant to an internal user. If you plan to tighten sharing settings, we can confirm beforehand that documents will still open. Please also leave the CLNG group in Entra alone: CLNG keeps its membership in sync.
How is our data kept separate from other customers?
Each customer is its own tenant. Every record is tagged with its customer, and isolation is enforced in the application and again in the database with row-level security that returns nothing if a tenant is not identified.
Which Microsoft 365 environments are supported?
Microsoft 365 commercial and GCC tenants are supported. GCC High and DoD tenants are not, because SharePoint Embedded is not available there. Azure for Government is not currently supported either. Offices that do not use Microsoft 365 are not supported yet; talk to us.
Where is our data stored?
Matter data is kept in a Microsoft Azure SQL database that we operate. Documents are stored in your own Microsoft 365 tenant.
Need more for a security review?
Tell us what your IT or security team needs, and we will answer it before you decide.