System overview

Seamless is a cloud service. You install nothing in your data centre. Seamless runs in Microsoft Azure in the Switzerland North data centre and is developed and operated by Seamlesswork AG in Zurich.

Seamless works with your Microsoft 365 through Microsoft's official interface, Microsoft Graph, and only with the permissions you have consented to. Your content such as files, messages or emails stays in your Microsoft 365.

The architecture at a glance

How it works, explained simply

1. A single, protected entry point

All calls from the internet, from the Admin Center to the Teams app, first arrive at Azure Front Door. This is the only public entry point. A Web Application Firewall checks every request and blocks attacks before they reach Seamless. The connection is always encrypted.

2. The applications run in a private network

Behind the entry point, the Seamless applications run in Azure Kubernetes Service (AKS). This network cannot be reached directly from the internet. Front Door forwards requests over a private connection (Azure Private Link), and an internal load balancer sends them to the right application:

3. Data only over private connections

The applications reach the database, cache, file storage, AI services and key vault exclusively through private endpoints in their own network. None of these services can be reached publicly from the internet.

4. No passwords in the code

The applications sign in with their own identity managed by Microsoft Entra ID (Azure Workload Identity). Secrets are kept only in the Key Vault and are provided securely at startup. There are no stored passwords in the program code.

5. Detect changes in Microsoft 365

When something changes in your Microsoft 365, for example a sensitivity label or the guest access of a team, Microsoft Graph notifies Seamless. A small function (Azure Function) receives the notification and puts it in a queue (Azure Service Bus). The agent processes the notifications in order. This way no change is lost, even when many arrive at the same time.

6. Controlled updates

New versions of Seamless are rolled out automatically and traceably. Every change to the platform is versioned, and new versions go to a test environment first before they are released.

7. Monitoring

Access to the entry point and application telemetry are logged centrally. This lets us detect errors and attacks early and help with support requests.

The building blocks

Seamless Admin Center and Teams app Web interface for admins and app in Microsoft Teams for users. Sign-in runs through Microsoft Entra ID, following Microsoft's security standards.

App telemetry Application Insights records processes and keeps the logs on teams, guests and policies for 90 days.

Customer configurations Your settings such as templates and policies are stored encrypted in Cosmos DB. Only Seamless accesses them. You can permanently delete your configurations at any time.

Microsoft Graph All parts of Seamless work with your Microsoft 365 tenant through Microsoft Graph.

Microsoft Entra ID Microsoft Entra ID and the Microsoft identity platform protect access to Seamless. Thanks to its own app registration, your Conditional Access policies also apply.

Microsoft 365 tenant Your Microsoft 365 tenant manages your data and provides the services for collaboration, security and compliance.

External services For individual features, Seamless uses other services, for example SharePoint, Resend for sending emails and reCAPTCHA to protect forms from abuse.

Platform and technology

• Microsoft Azure data centres in Switzerland for performance, scalability, availability, security and compliance.
• Azure Kubernetes Service runs the applications as containers, isolated in a private network.
• Next.js for fast web interfaces with server-side rendering, with shadcn components and Tailwind CSS for styling.
• Azure Functions and Azure Service Bus for processing change notifications.
• Azure Cosmos DB for the customer configurations and Microsoft Graph for access to Microsoft 365.

Which customer data we store

Seamless is built so that, within the meaning of the Swiss Federal Act on Data Protection (revFADP), we do not keep any personal data of your employees. We do not use any data for marketing or to contact you.

We store:

• User object IDs: The IDs from Microsoft Entra ID appear only in the telemetry (Application Insights), exclusively for support, and are deleted automatically after 90 days. We cannot use them to identify people or link them to names, email addresses or phone numbers.
• Tenant ID: This lets us see whether a tenant has already used the 30 day trial. We cannot see which company is behind it.
• Consent to the terms: Date and display name (not the email address) of the admin who accepted the privacy policy and terms and conditions, as proof.
• Configurations: Your templates and policies with titles, descriptions, IDs and technical details. If you no longer use Seamless, you can delete all configurations.

How we store customer data

All customer-specific configurations are stored securely in Cosmos DB. Each customer sees only their own configurations.

Details such as the assigned template, the responsible person of a guest or rules for extensions are stored by Seamless directly in your Microsoft Entra ID. Neither Seamlesswork AG nor third parties have access to them there.

Security in brief

• A single public entry point with Web Application Firewall
• Applications in a private network, not directly reachable from the internet
• Database, storage and key vault only over private connections
• No passwords in the code, identities through Microsoft Entra ID
• Encrypted connections and encrypted stored configurations
• Central logging and monitoring