Find My Data — documentation

The documentation home for the Find My Data platform (the current release is always the first entry in the release notes). Start here and follow the path that matches your role. Every document is grounded in the code in this repository and follows the platform’s honesty convention: capabilities are always described as built + validated live, built + mock-validated (live path feature-gated), or not built — never vaguer than that.

Start here

If you are…	Read first	Then
New to the product	Platform overview	Quick start
Installing or configuring it	Installation guide	Operations guide, Troubleshooting
Reviewing it for adoption (security/ARB)	Security review package	Threat model, Data catalog, Permissions manifest
Building on or integrating with it	HTTP API reference	Data schema, Architecture
Tracking releases and direction	Release notes	Roadmap, STATUS

User & adopter documentation

Document	What it covers
Platform overview	What Find My Data is, the Find → Confirm → Connect → Govern loop, personas/roles, core concepts glossary, honest capability matrix, invariants
Installation guide	Prerequisites, install/seed/run, the complete `FMD_*` configuration reference, feature-gate matrix, production lockouts, Azure deployment
Quick start guides	10-minute walkthroughs per persona: platform admin, governance admin, domain owner, remediation approver, auditor
Troubleshooting guide	Symptom → cause → resolution, grounded in the platform’s real error strings and gating messages
Release notes	Versioning policy (`year.month.day.x`) and per-release changes, newest first

Operations & engineering

Document	What it covers
Operations guide	Process topology, scanner fleet, durable queue and dead letters, metrics and readiness semantics, change-notification operations, backup, scale triggers
HTTP API reference	Every endpoint with method, path, required capability, and the auth/CSRF/error model
Data schema reference	Every table across all 12 migrations, conventions, constraints, and an ER overview
Architecture	Actual-code module architecture and diagram
Capacity model	Measured load-harness results and the documented scale triggers
CDX test runbook	The live Microsoft 365 validation runbook, including the recorded read-only CDX run

Governance, security & compliance

Document	What it covers
Security review package	The Architecture Review Board package: deployment model, trust boundaries, identity and authorization, data protection, secrets, audit, AI governance, residual risks, evidence-pointer checklist
Threat model	Trust boundaries, threat register (T1–T16) with mitigations and residual risk, retention caveats
Data catalog & handling	What data is acquired, derived, retained, and never stored — sensitivity, retention, access levels, redaction
Permissions manifest	Every Microsoft Graph permission the product uses or plans to use, least-privilege alternatives, protected/metered API notes

Decisions & direction

Document	What it covers
Decision register	Index and summaries of all ADRs
ADRs	The full architecture decision records (ADR-0001 … ADR-0014)
Roadmap	What is built vs. what the design documents call for next, by release
STATUS	The living honest-state document: completed / gated / known limitations / verification record
Review findings	Adversarial review findings and their resolutions
Handoff package	The original product, architecture, security, data-model, and delivery-plan documents

Conventions used across the documentation

Versioning: releases are year.month.day.x (e.g. 26.7.15.0 = first release on 2026-07-15; a same-day follow-up would be 26.7.15.1). The authoritative version lives in the repo-root VERSION file and PRODUCT_VERSION in packages/server/src/controlplane/routes.ts.
Honesty labels: /api/ready reports each integration as mock, live, blocked (enabled but prerequisites unmet), or disabled (not enabled). Documentation uses the same vocabulary.
Demo data: all fixture people and documents belong to the fictional Meridian Grove Holdings; nothing in the fixtures is real data.

​Find My Data — documentation

​Start here

​User & adopter documentation

​Operations & engineering

​Governance, security & compliance

​Decisions & direction

​Conventions used across the documentation