Compliance system of record for Microsoft 365
Watchtower runs 600+ security and compliance checks across every Microsoft 365 tenant, continuously. Every gap is tracked with its severity and how long it has been open, and every fix is written to a signed, tamper-evident record your auditors can verify themselves - hosted in the EU, or self-hosted in your own jurisdiction.
watchtower · postureIt runs as a continuous cycle, with no agents to deploy and nothing to schedule. Here is what that looks like, end to end.
Onboard each tenant through admin consent, a certificate, or a secret. Watchtower reads your configuration through Microsoft's own APIs, so there is nothing to install in your environment.
oauth · cert · secret
600+ checks run against industry security benchmarks and the CISA ScubaGear baseline, across Entra, Intune, Exchange, Teams, SharePoint, Copilot and DNS. New tenants are covered the moment you connect them, and you can add frameworks of your own.
benchmarks · scubagear (partial) · copilot · custom
Every misconfiguration carries a severity and an age. Drift shows up on the next sweep, so you can answer how long something has been broken - and restore an Intune setting through a signed, attributed change when you fix it.
durable · drift · intune restore
Export a signed pack for any tenant. Your auditor verifies the chain offline, without calling back to us.
ed25519 · offline · no network
A point-in-time scan tells you the state of your tenant in the moment it ran. It cannot tell you when a control started failing, whether it has failed before, or that nobody edited the result after the fact. For an audit, an insurance attestation, or a regulator, the moment is not the question. The history is.
When an auditor, a client, or your board asks you to prove it, export a signed evidence pack instead of assembling screenshots for a week. Every control, dated and attributed, ready to hand over.
signed pack · dated · attributed · export on demand
Watchtower sweeps Intune, Exchange, Teams, SharePoint, Entra, Purview and DNS on a continuous cycle, so a setting that quietly slips out of compliance surfaces in the next sweep, not six months later in front of an auditor.
continuous sweep · change-level diffing
Connect every Microsoft 365 tenant you operate under one account, each isolated at the database with Postgres row-level security, not in application code you have to take on faith. Onboard via OAuth admin consent, certificate, or secret.
per-tenant RLS · oauth · cert · secret
Most dashboards ask you to trust a green checkmark. Watchtower's are independently verifiable: you, your auditor, or your client can confirm the signed chain offline, with no call back to us. A checkmark you can always back up.
offline verifier · ed25519 · no network
Verify a sample pack yourself→Scans produce observations; observations update findings; findings persist across scans and carry their own lifecycle. The question a regulator or auditor actually asks is not “are we compliant today” - it is how long has this been broken?
Findings persist across scans - open, acknowledged, accepted-risk, resolved, muted. Age is a first-class column, not a timestamp you dig for.
Build your own frameworks, controls and checks - clone a built-in or start from scratch, scoped to your workspace. Custom checks run in a sandboxed boundary; your content is the same kind of object as ours, in the same table.
One failing control maps across the industry benchmarks, the ScubaGear baseline and the MITRE ATT&CK crosswalk at once. A new benchmark version is a migration, not a rebuild.
Frameworks, controls and checks are rows in a database, not code we ship. A new benchmark version is a migration; your auditor's bespoke control is a record; your internal policy is something you author - the same kind of object as our built-in catalog, in the same table.
Every state change lands in a hash-chained, signed, append-only audit trail. Download the evidence pack, run the verifier with no network, and confirm the signature chain yourself. Trust by math, not by our word - and where that boundary ends, we say so precisely.
Each observation is collected by a signed scanner and written once. Evidence is append-only - never edited, never overwritten.
Every audit event carries sha256 … ← prev. Break one link and the whole chain stops verifying.
Export the evidence pack, run the open verifier on your own machine, confirm the ed25519 signatures. No connection to us required.
Restore and template-apply are signed before execution, recorded in the same chain, and gated by an explicit per-tenant opt-in.
“The per-tenant opt-in is enforced in Watchtower's own application layer, not by Microsoft - a contractual and operational boundary, not a cryptographic one. We name it rather than disguise it.”
Hosted on Hetzner in Germany. German jurisdiction over the audit records.
The same engine drives self-host and hosted. No closed-source magic in the audit chain.
Where a capability can't be made cryptographic, we name the boundary instead of hiding it.
Open, acknowledged, accepted-as-risk, resolved. A lifecycle that survives across scans, not a snapshot that resets.
Before you apply a fix or push a baseline across your estate, Watchtower predicts exactly what it will do - which findings would open or clear, and which users a Conditional Access change would lock out - and emits it as a signed artefact you can hand to a change board or regulator. Not an AI estimate; a deterministic computation you can verify.
Single-tenant modeling is rolling out now. Cross-tenant blast-radius across a fleet is in progress.
Define the configuration a tenant should hold, assign it across the estate, and push the settings through the same signed path as restore. From then on Watchtower watches: the moment a setting moves away from the baseline, it surfaces as a tracked finding - with the expected value and the tenant named.
Drift detection against a baseline is live. Pushing settings is rolling out, Intune-focused; cross-tenant rollout is in progress.
ScubaGear is excellent, free, open-source, and you should run it. It measures your Microsoft 365 baseline at a point in time. Watchtower is not a replacement for that check - it is the system of record and action built on top of it. Here is the honest division of labour.
| Capability | A point-in-time scanScubaGear, Secure Score | Watchtowersystem of record |
|---|---|---|
| Point-in-time posture check | Yes | Yes |
| Tells you how long a control has been failing | No | Yes |
| Findings persist with a lifecycle across scans | No | Yes |
| Signed, tamper-evident history | No | Yes |
| Evidence pack you can verify offline | No | Yes |
| Remediation | No | Intune only |
| Many tenants in one place | No | Yes |
If all you need is a point-in-time score, ScubaGear alone is enough - and we will tell you that. If you need to prove the history to a regulator, an auditor, or your board, that is what we are for. Our ScubaGear coverage is partial, and restore is Intune only - both stated plainly in the product.
Posture data is only useful where your team already works. Watchtower connects agentlessly and exposes its findings over an API and webhooks. It integrates with your SIEM; it is not one.
Same engine, same audit chain, whichever way you deploy. The only real choice is where the records live - and we name it plainly. Prices are not published yet; join the waitlist and we will quote per tenant.
Run Watchtower in your own jurisdiction, on your own disks, against your own audit chain. Data sovereignty is structural, not a setting.
Hosted on Hetzner in Germany. Convenience tier - it asks you to trust our infrastructure, and we say so. German jurisdiction over your audit records.
One schema serves a large enterprise group or a managed-service practice. One entity or six hundred - volume pricing across everything you operate.
Early access for launch partners. No prices published yet, no card required to join the waitlist.
Dated roadmaps become commitments customers plan around and vendors quietly miss. This is the trajectory the platform is built to move along - expanded one capability at a time, demand first.
Pre-launch · onboarding launch partners
Join the waitlist for early access. We'll only email you about early access - no spam, no list-sharing.
Already have an account? Sign in · Prefer to talk first? Tell us about your environment