Security and trust
How MA Technology Services, LLC handles security for its own products and operations, how to reach us about a security issue, and the security work we have published under our own name.
Security contact
Report a security issue in EntraMigrator or in anything we operate to max@armah.ai. We acknowledge reports promptly and coordinate disclosure with the reporter. Machine-readable contact: /.well-known/security.txt (RFC 9116).
Disclosure policy
Vulnerabilities we find in third-party products are reported privately to the vendor through its coordinated disclosure process. We do not publish them, name targets, or seek credit. What we publish here concerns our own products only.
Product security posture
EntraMigrator runs under behavioral endpoint detection with zero exclusions, ships only signed binaries, verifies signatures at every code boundary, and isolates each customer in a dedicated control plane. Detailed architecture and the full assessment reports are available to qualified organizations under NDA.
Published security work
Security assessments of our own platform, published in redacted form. Each summary states its scope, method, findings by severity, and what was changed as a result.
EntraMigrator platform: pre-GA audit, red team exercise and architectural remediation (May 2026)
Ten rounds of static security review, a cold-session adversarial red team exercise against the production reference tenant, containment and remediation of a critical finding within 24 hours, and two architectural sprints that replaced shared-secret operator identity with signed assertions and removed all storage credentials from the package build chain. Published 17 October 2026 from the internal report dated 19 May 2026.