Your credentials, not ours
Frank has no Microsoft app or GitHub app of its own that you have to trust. You create the access in your own tenant or account, choose how far it reaches, and can revoke it there at any time without asking us.
What Frank reads, and the access it needs.
Frank reads only what you point it at, and never writes back to your systems. You can start from files you upload and connect nothing at all.
§ 01
Files you upload
Where most organisations start. Frank reads the files you give it, each time you upload them, and needs no access to anything of yours.
| Source | What Frank reads |
|---|---|
| Spreadsheets and documents | Your Statement of Applicability and registers (obligations, risks, incidents, exceptions, suppliers, assets, assumptions) as Excel, CSV or markdown files. |
| ISOPlanner | The risk assessment, risk treatment plan, risk changes and asset details exports, as the Word files ISOPlanner produces. |
Anything that exports to Excel, CSV or markdown works through upload today.
§ 02
Connections Frank keeps reading
Once you connect a source, Frank reads it again on a schedule, so what it holds stays current without another upload. Every connection feeds one area, and you choose which. Once you remove a connection, no further pull starts, a pull already under way finishes fetching but writes nothing, and what a list or alerts connection landed is withdrawn.
| Source | What Frank reads | Access you grant | How often |
|---|---|---|---|
| SharePoint lists | The lists you name, such as a risk register, incident log or exception register. Nothing else on the site. | Read-only, through an app registration you create in your own Microsoft tenant. We recommend Sites.Selected, which limits it to the sites you grant. | Every hour, or less often if you choose |
| SharePoint or OneDrive library | One library: your Statement of Applicability, the file that tells Frank how to read it, and the register files that file names. | Read-only, through the same kind of app registration as SharePoint lists. One registration can serve both. | Every hour, or less often if you choose |
| GitHub repository | One repository: your Statement of Applicability, the file that tells Frank how to read it, and the register files that file names. | Read-only, through a fine-grained access token you create, limited to that one repository and its contents. | Every hour, or less often if you choose |
| GitHub security alerts | The repositories you name, which need not hold your statement: the Dependabot, code scanning and secret scanning alerts GitHub holds open on them, and whether each default branch requires an approved pull request, each only where you name the controls it bears on. Where GitHub produces none of a kind for a repository, or its plan cannot enforce branch rules, Frank shows it as a gap for you to decide on. | Read-only, through a separate fine-grained access token you create, limited to those repositories and to the permission for each kind it reads: Dependabot alerts, Code scanning alerts, Secret scanning alerts, and Administration for branch rules, which also lets the token read the repository’s settings. A committed secret is recorded by its type, never its value. | Every hour, or less often if you choose |
We add connections as customers ask for them, so if you would rather Frank read from a tool you use, tell us which.
§ 03
How Frank handles access
Encrypted, and used for one thing
Credentials you give Frank are encrypted at rest and decrypted only at the moment Frank reads from the source you connected. They are sent nowhere else.
Pointers, not copies
Frank records where each piece of evidence lives in your systems rather than keeping a second copy of it. An uploaded file is kept for your retention window, 30 days unless you change it and never more than 365, then erased.
No person or AI model reads it
Frank checks your records against the same fixed rules every time. Nobody at Frank reviews your records to produce findings, and no AI model processes your content.
§ 04
Public sources
On every plan, Frank can also watch public sources and put anything relevant in front of a named person to review by a set date. You choose which to turn on. We add sources as customers ask for them.
| Source | Where it comes from | What reaches you |
|---|---|---|
| Legislation | The Australian Federal Register of Legislation, legislation.gov.uk, EUR-Lex and the US Federal Register. | New legislation that mentions a law you cite or a topic you choose. |
| ASD’s ACSC alerts and advisories | cyber.gov.au, run by the Australian Signals Directorate. | Every alert and advisory, or only those that name terms you choose. |
| ISM releases | The Australian Signals Directorate’s published editions of the Information Security Manual. | Each new edition and patch, linked to the controls of yours it changes. |
| Software flaws under attack | The US government’s CISA list of vulnerabilities known to be exploited. | New entries for the vendors and products you name. |
| Flaws in open-source packages | OSV, which gathers the GitHub Advisory Database and the open-source ecosystems’ own advisories. | Advisories against the packages and versions your builds carry, at the severity you choose. |
Frank reads these sources whole and matches them against your records itself, so nothing of yours is sent to them, with one exception. If you turn on the OSV feed, Frank sends OSV the ecosystem, name and version of each package you declare, except those you mark as your own, and nothing else. You give it that list as the bills of materials your builds produce or package lists you keep, either uploaded or read from one GitHub repository (files kept in it, a build’s output, or GitHub’s own list of the packages it uses) through a read-only token you create. Leave the feed off and nothing is sent.
§ 05
Where your data is held, and what happens if you leave
The application and its database run in Sydney, Australia, and everything we store of your content is held in Australia. The one exception is the OSV feed, if you turn it on: the names and versions of the packages you declare are sent to OSV, which is operated from the United States and may keep them, as sub-processors and hosting sets out. Where a Commonwealth entity needs certified hosting, Frank is deployed for it on a certified provider.
If you leave, you have 30 days to ask for the complete export of your records, and we deliver it within that time. We then delete or de-identify what we hold within a further 30 days, subject to backups expiring and anything the law requires us to keep.
The full detail is in sub-processors and hosting, the data processing agreement and continuity and exit.
Nothing to connect first
Start from the files you already keep.
Upload a spreadsheet and see what Frank finds before you give it access to anything.