Privacy Policy

1. Purpose of DevAtlas

DevAtlas is an internal AI-powered knowledge companion operated exclusively for authorised employees and contractors of the organisation. Its purpose is to improve the discoverability and reuse of your team's knowledge by indexing approved internal sources — including documentation, repository metadata, architecture documents, runbooks, postmortems, and onboarding resources — and making them searchable via natural language.

DevAtlas does not serve external users, customers, or the public.

2. Data Sources Used

DevAtlas indexes content from the following organisation-approved internal sources:

• Azure DevOps — repository metadata, work items, pipeline definitions, and wiki pages
• SharePoint / Confluence — internal documentation, runbooks, playbooks, and how-to guides
• Architecture & design records — ADRs, system diagrams, and technical design documents
• Postmortems & incident reports — approved incident retrospectives published to internal channels
• Onboarding materials — team guides, environment setup docs, and role-specific learning paths
• Organisational knowledge base — FAQs, standards, and best-practice guides curated by engineering teams

DevAtlas does not access personal files, private repositories, email, calendar data, or any source not explicitly connected and approved by the platform owner.

3. Azure DevOps Repository Metadata

When connected to an Azure DevOps organisation, DevAtlas may read and index:

• Repository names, descriptions, and branch information
• README files and wiki content
• Work item titles, types, and metadata (not full descriptions unless explicitly published)
• Pipeline and release definition names
• Team project names and area paths

Source code files are not indexed or stored unless a specific repository is explicitly configured as a knowledge source by a DevAtlas administrator. All access uses organisation-managed service principal credentials governed by your Azure AD policies.

4. Documentation Indexing

Documentation connected to DevAtlas is chunked, embedded, and stored in Azure AI Search within your organisation's Azure subscription. This process involves:

• Splitting documents into semantically meaningful passages
• Generating vector embeddings using Azure OpenAI (text-embedding model)
• Storing the index within your organisation's Azure AI Search resource

Original document content is not duplicated outside your Azure environment. Index data is owned by the organisation and is subject to the same access controls as the source documents.

5. User Query Processing

When a user submits a search query or chat message in DevAtlas:

1. The query text is sent to Azure AI Search to retrieve relevant knowledge passages.
2. The query and retrieved passages are sent to Azure OpenAI to generate a synthesised answer.
3. The query, answer, and cited sources are logged to the DevAtlas usage store (Azure Table Storage or equivalent) to support quality improvement and usage analytics.

Query logs are accessible only to DevAtlas administrators and are used solely for improving relevance and understanding usage patterns. Query logs are not shared with Microsoft or any third party.

Queries sent to Azure OpenAI are governed by your organisation's Azure OpenAI data processing agreement. Microsoft does not use your prompts or completions to train shared models when using enterprise Azure OpenAI deployments.

6. Azure OpenAI Usage

DevAtlas uses Azure OpenAI Service deployments provisioned within your organisation's Azure subscription for the following functions:

• Embedding generation — converting documents and queries to vector representations for semantic search
• Chat completions — synthesising answers from retrieved knowledge passages using a Retrieval-Augmented Generation (RAG) pattern

Your organisation's Azure OpenAI resource is configured with:

• Private endpoints / VNet integration (where applicable)
• No public internet exposure of prompts or completions
• Managed identity or service principal authentication (no shared API keys in source code)

Data processed by Azure OpenAI remains in the Azure region configured by your organisation and is subject to Microsoft's enterprise data processing terms.

7. Data Retention

Users may request deletion of their query history by contacting the DevAtlas platform owner (see Contact section below).

8. Internal Use Only

DevAtlas is classified as an internal enterprise application. Access is restricted to authenticated employees and authorised contractors via the organisation's identity provider (Azure Active Directory / Microsoft Entra ID).

The following are strictly prohibited:

• Sharing DevAtlas access credentials or session tokens with external parties
• Exporting or forwarding indexed content to unauthorised external systems
• Using DevAtlas to process personal data not related to engineering knowledge
• Attempting to access knowledge sources beyond your authorised role

9. Security and Access Controls

DevAtlas enforces multiple layers of security:

• Authentication: All users must authenticate via Azure AD / Entra ID SSO. Unauthenticated requests are rejected.
• Authorisation: Role-Based Access Control (RBAC) governs which knowledge sources each user can query.
• Encryption in transit: All communication between the DevAtlas frontend, backend API, Azure AI Search, and Azure OpenAI is encrypted using TLS 1.2+.
• Encryption at rest: Azure AI Search indexes and storage are encrypted at rest using Microsoft-managed or customer-managed keys per your Azure configuration.
• Network isolation: Backend services are deployed within your organisation's Azure Virtual Network and are not publicly accessible.
• Secrets management: API keys, connection strings, and service principal credentials are stored in Azure Key Vault and never embedded in source code.
• Audit logging: All administrative actions and data access events are logged to Azure Monitor / Log Analytics for security review.

10. Contact Information

For questions, concerns, or data requests related to this Privacy Policy, contact:

DevAtlas Platform Owner Engineering Productivity & Developer Experience Team Internal: search "DevAtlas" in the internal directory or raise a request in the DevAtlas Teams channel.

Data Protection Officer (DPO) For data privacy matters that require escalation, contact your organisation's DPO through the standard data privacy intake process.

---

This policy is reviewed annually or when significant changes are made to the platform. Effective date: 16 July 2026.