Security
Security model
How StageReady protects client credentials and one-time codes.
The 6-digit code
Each provisioning code is single-use and short-lived. Only a hash of the code is ever stored — never the code itself — so even a database leak reveals no usable codes. Repeated wrong attempts invalidate it.
Client credentials
Credentials for a client's Microsoft environment are stored only in Azure Key Vault. They are never placed in our database, in configuration, on the USB, or on the device. The application can only read them, for the moment a job needs them.
Sign-in and offboarding
Technicians authenticate with their Microsoft 365 work account. When you disable a departed employee in your own tenant, they lose access to StageReady automatically — within the hour. An administrator can also revoke access instantly.
Access isolation
Access is scoped per technician and per client: a technician only sees the clients they're assigned to. Every action is written to a permanent audit trail.
A lost USB
Nothing happens. The stick contains no passwords, no client information, and no logic — just a boot prompt asking for a code. See data residency and GDPR for how the rest of your data is handled.