Terms of Service

Kronikl is operated by Asumafy LLC. These terms are the agreement between you and us — there is no separate contract and no sales process. You sign in, and these terms apply.

They are meant to be read. If something here is unclear, email hello@kronikl.io and we will explain it or fix the wording.

Last updated: 30 August 2026

1. Who this is between

Us is Asumafy LLC, the company that operates Kronikl. You is the organization whose Azure tenant is connected to Kronikl. If you are signing in for a company, you are agreeing to these terms on that company's behalf and confirming you are allowed to.

Kronikl is for organizations. It is not for consumers, and not for anyone under 18.

2. Accepting these terms

You accept these terms when you sign in and an organization is created for you, and each time you use Kronikl afterwards. Signing in needs a Microsoft work or school account. We do not issue passwords and there is no Kronikl account to create — your identity comes from Microsoft Entra ID.

3. What Kronikl does

Kronikl reads the record of changes in your Azure environment and keeps its own history of it: a change timeline, configuration snapshots and property-level diffs, alert rules, and an export.

Kronikl's own access is read-only. The Azure role it holds is Reader, and the permissions its servers use unattended contain no write operation. The one exception is deliberate and is yours: if you choose the button in step 4 rather than the command, the role assignment is created with your administrator's own credentials, in their browser, under their name in your Activity Log.

4. How Kronikl gets access, and how you take it away

Access takes two steps, and you control both:

1. An administrator consents. Kronikl asks for five permissions: three read-only Microsoft Graph application permissions — Directory.Read.All, RoleManagement.Read.Directory and AuditLog.Read.All — and two delegated ones, which act as the person signed in and never as Kronikl: User.Read for your name and email, and user_impersonation on Azure Service Management, which lists the subscriptions and management groups you can already see so you can choose which to track.
2. An administrator assigns the role. Azure's built-in read-only Reader, at the scope you choose — a management group, or individual subscriptions. Kronikl writes the exact command for them to run, or creates the assignment in their browser with their own Azure credentials: it appears in your Activity Log under their name, and succeeds only where they already hold the privilege to make it. Kronikl cannot grant itself access — its own credentials can only read.

About user_impersonation, the broadest-sounding line on the consent screen. It is the signed-in administrator's own Azure access, exactly as wide as their access already is — writes included, for somebody who can already write. What bounds it is where it is spent, not what it permits: the token is obtained in your browser, used there, and never sent to Kronikl's servers and never stored. It is spent listing your subscriptions, and — only if your administrator presses the button in step 2 rather than running the command — on the one request creating the Reader assignment they have just been shown in full.

Consent alone is not access. Until step 2 is done, Kronikl can read your directory and nothing in your subscriptions. The product shows you which state you are in.

We hold no password, no client secret and no API key for your tenant. Access is a federated credential exchanged for a short-lived token each time it is needed. There is no stored credential of yours for us to lose or to forget to delete.

You can end our access at any time by removing the role assignment or withdrawing consent in your own directory. Withdrawing consent stops new tokens being issued rather than canceling one already in hand, so access ends in minutes — at the outside, the lifetime of a single Entra token, which Microsoft sets and which is typically an hour.

5. Your data

The history Kronikl collects describes your cloud estate and your people's actions. It is yours. You decide it is collected; we hold it for you. In data protection terms, you are the controller and we are the processor.

We use it to run the service for you and for nothing else. We do not sell it, do not share it with third parties, do not use it to train models, and do not use it for advertising.

We remove credential-shaped values before storing a record. Configuration and audit records often carry connection strings, keys and passwords. Kronikl replaces the ones it recognizes, by field name and by the shape of the value, so a change to a secret still shows as a change without the value being kept. That is pattern matching, not a guarantee: Azure decides what its own records contain, and a credential in a field we do not recognize can reach our storage. Treat your change history as sensitive.

Your data is separated from other customers' in the database itself, not in application code, so a bug in the application cannot cross that boundary.

6. Where it is stored

In Microsoft Azure, in the United States, encrypted in transit and at rest. Microsoft is our only infrastructure provider: Azure hosts the service and the database, and Azure Communication Services sends our email. If we add another, we will publish it and tell you before it starts processing your data.

7. This is a beta

Kronikl is in beta. The plans and prices on our website are the ones we charge. A free plan is available and stays free; nothing turns a free account into a paid one without you choosing it.

If we change what a plan costs or what it includes, we will tell you at least 30 days in advance, and you will be free to export your history and stop rather than pay.

Kronikl is provided as it is. We make no commitment about uptime, response time, or how quickly we would recover from a failure — including the loss of collected history. Do not build a process that breaks when Kronikl is unavailable, and do not make Kronikl your only copy of anything you need. We will make reasonable efforts to keep it running and to tell you when it is not.

It may change or end. We may change how the product works, and we may discontinue it. If we discontinue it we will give you at least 30 days and keep the export working throughout, so you can take your history with you.

8. What the record is, and what it is not

Kronikl's history is a best-effort record built from what Microsoft's APIs report — the Azure Activity Log, Resource Graph, Azure Resource Manager and Microsoft Graph. It is not a certified, independently verified or complete record, and we do not warrant that it is accurate or complete.

• If Azure does not report a change, reports it late, or reports it incompletely, Kronikl's record inherits that.
• If your tenant connection breaks or Kronikl is unavailable, changes in that period may be missing. The product shows the health of the connection and when it last collected; check it before relying on a period.
• The timeline hides routine platform automation by default. Those events are stored and never deleted, every screen says how many were hidden, and the export includes them with a routine column so the decision is yours.
• Alerts are a convenience, not a guarantee. A rule that cannot be evaluated reports that it could not, rather than reporting success — but the absence of an alert is not evidence that nothing happened.

Do not rely on Kronikl as your only source of audit evidence, and do not present its output as a certified record. Using Kronikl does not make you compliant with any standard, framework or regulation, and we make no representation that it does.

9. How far back you can look

Your plan sets how far back the product will answer questions: 14 days on Free, 90 days on Pro. This clamps what a query may ask for. It does not delete anything. The rows are there either way, so moving to a longer window makes older history visible immediately. When a plan window shortens a range you asked for, the product says so plainly — including in the export, both in a response header and in the file itself.

10. Your responsibilities

• Connect only a tenant you are authorized to connect, with the approval of someone who can give it.
• Keep your Entra ID accounts secure. We rely on Microsoft to tell us who you are; anyone who can sign in as one of your people can see what that person can see.
• Manage your own team. You decide who is invited and what role they hold. Removing someone or changing their role takes effect on their next sign-in — sessions last an hour — so if the removal is urgent, disable the account in Entra ID as well.
• Do not attempt to reach another customer's data, degrade the service, or test its security outside what our security policy permits (section 12).
• Do not resell Kronikl or run it as a service for others without asking us first.

11. Getting your data out

Any signed-in member of your organization can export your change history as CSV or JSON, from the product, at any time, without asking us. It includes the routine events the timeline hides, and carries provenance columns saying whether each fact came from Azure or was reconstructed later. If a person's access is scoped to particular subscriptions or resource groups, their export honors that scope like every other screen.

Full-history exports are recorded: who exported, when, with what filter, and how many rows. The record says that a read happened. It never copies what was read.

12. Security, and reporting a problem

We publish a security policy — what we consider serious, the design properties you can test us on, and the gaps we already know about — at /.well-known/security.txt.

Report vulnerabilities to security@kronikl.io. We acknowledge within 3 working days and tell you what we think the impact is, including when we think it is lower than you do and why.

We will not pursue or support legal action against anyone who reports in good faith, stays in scope, avoids privacy violations and service degradation, and gives us a reasonable chance to fix the issue before disclosing it.

If we discover a security breach affecting your data, we will tell you without undue delay, with what we know at the time and what we are doing about it.

13. Data protection

You are the controller of the personal data in your change history — the names, work email addresses and directory identifiers of the people who make changes in your tenant, and of the people on your team. We are the processor. We process it only to provide the service, and only on your instructions, which for a self-service product means: the configuration you set inside Kronikl, and these terms.

If you need a data processing agreement under the GDPR or UK GDPR, email hello@kronikl.io and we will put one in place.

14. Ending it

You can stop at any time. There is nothing to cancel and no notice to give.

Three different things you can do, and they are genuinely different:

• Disconnect a tenant. An owner can disconnect a connected Azure tenant from inside the product. Collection stops immediately. The history already collected stays, so you can still read and export it.
• Withdraw access in Azure. Remove the role assignment or the consent in your own directory (section 4). This works whether or not you tell us, and it is the one that does not depend on us doing anything.
• Close your account. An owner can request account closure from inside the product. We delete your organization and everything in it — change history, configuration snapshots, diffs, alerts, alert rules, users and tenant connections — from our live systems within 7 days. Copies held in routine encrypted backups age out within 7 days and are never restored to serve anyone.

Export anything you want to keep before you close the account. Deletion is not reversible and we do not hold a copy for you.

Two records survive deletion, on purpose: our own access log, and the history of plan changes. Neither contains any collected data, and keeping them is the whole reason they are worth having.

Inactivity does not delete anything. If you simply stop using Kronikl, your data stays until you ask us to remove it or we close the account under the next paragraph.

We can end it too. We may suspend or close your account if you break these terms, if your use threatens the service or another customer, or if we are legally required to. Except where the problem is urgent or legal, we will tell you first and give you a chance to export.

15. Intellectual property

Kronikl — the software, the design, the name — is ours. Using it transfers none of that to you. Your data is yours. We claim no ownership of it and no license to it beyond what running the service for you requires.

If you send us feedback, ideas or bug reports, we may use them to improve the product without owing you anything. We will not name you as the source without asking.

16. Liability

Kronikl is provided as-is. Beyond what is written in these terms, and to the extent the law allows, we give no warranties — including no warranty that it will be available, that its record is complete, or that it fits any particular purpose.

Neither of us is liable to the other for indirect or consequential loss, or for lost profits, lost revenue, or the value of lost data.

Our total liability to you, for everything arising out of these terms, is limited to the greater of $100 or the fees you paid us in the twelve months before the claim.

Nothing here limits liability that cannot be limited by law, including for death or personal injury caused by negligence, or for fraud.

17. Changes to these terms

We may change these terms. If a change materially affects your rights — pricing, how we handle your data, liability — we will email you at least 30 days before it takes effect. Corrections and clarifications take effect when we publish them, and the date at the top changes with them.

If you do not accept a change, stop using Kronikl and close your account. That is the remedy, and it is a real one: there is no fee, no term and no lock-in.

18. The rest

• Governing law and courts. These terms are governed by the laws of the Commonwealth of Virginia, without regard to its conflict-of-laws rules. Any dispute arising out of them will be brought exclusively in the state or federal courts located in the Commonwealth of Virginia, and both of us consent to the jurisdiction of those courts.
• Whole agreement. These terms and our privacy notice are the whole agreement about Kronikl. Marketing pages are not part of it; where they disagree with this document, this document wins.
• If one clause fails, the rest stays in force.
• Not enforcing is not waiving. If we do not enforce something straight away, we have not given it up.
• Transfer. You may not transfer this agreement without our consent. We may transfer it to a successor if the business is sold, and we will tell you.
• Notices. To you: by email to the address on your account, or in the product. To us: hello@kronikl.io.

19. Contact

• General and legal: hello@kronikl.io
• Support: support@kronikl.io
• Security: security@kronikl.io

Kronikl is a product of Asumafy.