Overview
Before a third-party web part is allowed on the intranet, somebody has to answer three questions: where does our data go, who can see it, and what does the vendor receive. This article answers them for the Vitextra products for SharePoint Online and Microsoft Teams in one place, so that the answers can go straight into a security questionnaire or a data protection assessment.
The statements below describe the current versions of the products as implemented in their source code. Product-specific details are in the articles linked in each section.
Summary for administrators
| Question | Answer |
|---|---|
| Where is business data processed? | In the browser of the user, by scripts running on the SharePoint page or in the Teams client |
| Under whose identity? | The signed-in user. All API permissions are delegated; there is no service account and no app-only access |
| Where is business data stored? | Only inside your Microsoft 365 tenant: SharePoint lists, web part properties on pages, OneDrive, Microsoft Entra ID profiles |
| Do Vitextra servers store your lists, people data, tasks, files or passwords? | No |
| What do Vitextra services receive? | Technical identifiers for the license check and usage telemetry; for four products, the saved settings of the Teams personal app; for RSS Reader, the addresses of the configured feeds |
| Does any data leave Microsoft 365 for a third party? | Only when you configure it: YouTube or Vimeo embeds, Azure DevOps, an external webhook in Employee Details |
| Where is the data residency of your content? | The geo location of your Microsoft 365 tenant; Vitextra does not move or copy content |
How the products process data
Every Vitextra product for Microsoft 365 is a SharePoint Framework solution: a package of scripts that SharePoint loads into the page. The scripts run in the browser of the user and read data through the SharePoint REST API and Microsoft Graph with a token issued for that user. Consequences:
- The user's permissions are the ceiling. A web part can show a list item, a document, a colleague or a task only if the user could open it in SharePoint, Outlook or Teams without the web part. Security trimming of SharePoint search and the address-book settings of Microsoft Entra ID apply unchanged.
- Nothing is processed on Vitextra servers, with one exception described below (the feed service of RSS Reader). There is no Vitextra backend that reads your SharePoint content, indexes it or keeps a copy.
- The API permissions are delegated. They are approved once by a tenant administrator and are listed in KB10360. How to Approve Microsoft Graph API Permissions for Vitextra Solutions in the SharePoint Admin Center.
Where each product stores data in your tenant
The settings of every web part — which list to show, which columns, which layout — are stored in the properties of the web part, inside the page in the Site Pages library of the site. They are readable by everyone who can read the page and are versioned with it. Beyond that, the products use the following storage.
| Product | Data created or changed by the product | Location |
|---|---|---|
| Absence & Coverage | Absence types, absence requests, balances, substitutions, public holidays, settings | Six SharePoint lists on the site you select: AbsenceTypes, Absences, Substitutions, Balances, Holidays, Settings (see KB10351. Absence & Coverage Lists: What Is Stored Where) |
| Announcements Carousel | Announcements; the web part adds a VtxPriority column to the list | An Announcements list on the site, selected or created by the editor |
| Questions & Answers | Questions, answers, categories, contacts, comments; the web part adds its columns to the list | A custom list on the site, selected or created by the editor |
| Quick Poll | Poll questions, options and responses | Two lists created on the site: Vitextra Quick Poll Questions, Vitextra Quick Poll Responses |
| Password Vault | The encrypted vault of each user | One file, vitextra-password-vault.json, in the application folder of the user's own OneDrive; entries are encrypted in the browser before they are written |
| Employee Details | Profile fields a user edits about himself or herself: about me, interests, responsibilities, projects, schools, skills, languages, certifications, awards, web accounts | The user's profile in Microsoft Entra ID, through Microsoft Graph; the data belongs to the profile and is visible wherever Microsoft 365 shows it |
| List Filter Online | Nothing of its own; it reads and, on the user's command, changes items of the connected list (delete, rename, create folder, restore a version, like, create an index) | The connected SharePoint list or library |
| Employee Directory, Organizational Chart, My Tasks, Smart Search, RSS Reader, Smart Tiles, QR Code Generator | Nothing beyond the web part properties | — |
📝 Note
Lists created by a product are ordinary SharePoint lists. They inherit the permissions of the site, appear in Site contents, are covered by the retention, eDiscovery and backup of your tenant, and remain when the product is removed (see KB10362. How to Remove a Vitextra Solution from SharePoint Online and Microsoft Teams).
Which products write to Microsoft 365
Most products only read. The write operations, all performed with the rights of the user who triggers them, are:
- Absence & Coverage — creates and updates items in its six lists (requests, decisions, substitutions, balances).
- Quick Poll, Questions & Answers, Announcements Carousel — create their lists and columns; Quick Poll stores votes, Questions & Answers stores submitted questions and comments.
- Employee Details — updates the profile of the signed-in user in Microsoft Entra ID (the fields listed above). It does not change other users' profiles or the attributes managed by HR systems (name, job title, department, manager); for those it offers a change request, see below.
- Password Vault — writes the vault file to the user's own OneDrive.
- List Filter Online — changes items of the connected list only when a user uses the corresponding command.
- My Tasks — reads tasks only; the optional quick actions of the Azure DevOps Query web part change work items in Azure DevOps (see KB10303. My Tasks: Required Permissions, Privacy and Security).
Employee Directory, Organizational Chart, Smart Search, Smart Tiles, RSS Reader and QR Code Generator write nothing.
Data kept in the browser
Some products keep data in the local storage of the browser to open faster or to remember personal settings. This data stays on the device, is specific to the user's browser profile and is removed when the browser data for the SharePoint site is cleared.
| Product | What is kept | How long |
|---|---|---|
| Employee Directory | The loaded employee list (compressed), the user's favorites, personal sort settings | The list is refreshed when older than 24 hours |
| Organizational Chart | The loaded directory snapshot | Refreshed when older than 12 hours |
| My Tasks | Personal view settings; the last loaded task list (session only) | Task list for up to 15 minutes |
| List Filter Online | The last applied filter and named saved filters per web part | Until cleared |
| Smart Search | Saved searches, the last queries (session only) | Until cleared |
| RSS Reader | The last loaded feed items (session only) | Up to 30 minutes |
❗ Important
On shared or kiosk computers, the cached employee list of Employee Directory and Organizational Chart is readable by the next user of the same browser profile. Use separate Windows accounts, a private window or a policy that clears site data at sign-out.
What is sent to Vitextra services
The products contact Vitextra for four purposes. None of these requests contains SharePoint list items, documents, people data, tasks or passwords.
| Purpose | Products | What is sent | Where |
|---|---|---|---|
| License check | All | Tenant ID, the object ID of the user account in Microsoft Entra ID, the address of the site, the identifier, name and version of the product | vitextra.com |
| Teams personal-app settings | Employee Directory, Organizational Chart, RSS Reader, Absence & Coverage | The web part settings that an administrator saves with Save Settings in the Personal app (Microsoft Teams) group — layout and display options, for RSS Reader the list of feed addresses — stored per tenant and product so that the personal app in Teams can read them | vitextra.com |
| Feed service | RSS Reader | The addresses of the configured feeds, together with the identifiers of the license check; the service downloads the feeds and returns the items to the browser | vitextra.com |
| Usage telemetry | All | An event when a web part loads: product name and version, the ID and address of the site, the object ID of the user account, the interface language and whether the web part runs in Teams; and technical details of errors (product, version, site address) | Azure Application Insights |
| Product files | All | An ordinary file request: the scripts and icons of the web parts are downloaded from the Vitextra content delivery network | static.vitextra.com, vitextra-storage.azureedge.net |
In these requests the user is identified by the object ID of the account — a GUID — not by name or e-mail address. The processing of this data by Vitextra is described in the Privacy Policy; for a data processing agreement or a completed security questionnaire, contact Vitextra support.
📝 Note
RSS Reader is the one product whose content passes through a Vitextra server: feeds are downloaded by the feed service, not by the browser, so that feeds without cross-origin headers can be shown and the user's browser never connects to the feed hosts. The service receives the feed addresses, not any data from your tenant. Feeds that are reachable only inside your network cannot be displayed.
Third-party hosts
Outside Microsoft 365 and Vitextra, a web part connects to another host only in these configurable cases:
- Smart Tiles — a tile that points to a YouTube video loads its thumbnail from
img.youtube.comand plays it in an embedded player fromwww.youtube.com. - Questions & Answers — an answer with a video address embeds the player of
www.youtube.comorplayer.vimeo.com. - My Tasks — an Azure DevOps source connects to
dev.azure.comandapp.vssps.visualstudio.comas the signed-in user. - Employee Details — if an administrator configures a change request address, the web part posts profile change requests (the employee, the manager, the attribute, the old and new values, a comment) to that address; typically a Power Automate flow or a Logic App of your own.
- File-type icons are loaded from Microsoft's content delivery networks (
res.cdn.office.net,static2.sharepointonline.com,spoprod-a.akamaihd.net).
If none of these features is configured, the browser talks only to your tenant and to the Vitextra hosts listed above.
Data residency and GDPR
- Content stays where it is. Lists, files, profiles and vault files are stored by Microsoft 365 in the geo location of your tenant. Vitextra does not move, copy or index them.
- What Vitextra holds about your tenant is limited to the technical data above: the Tenant ID with its license status and subscription, the saved Teams settings of four products, and telemetry records. You can ask for the deletion of these records when you stop using the products.
- Account data. The Vitextra account used to buy and manage subscriptions (name, e-mail, billing details) is governed by the Privacy Policy and the Terms of Service; payments are processed by Stripe.
- Roles. For the data in your tenant you are the controller and Microsoft is your processor; Vitextra does not become a processor of that data because its software never receives it. For the technical identifiers sent to Vitextra services, the Privacy Policy describes the purpose and retention.
Network requirements
If outbound connections from the users' network are restricted, allow HTTPS to:
vitextra.com— license check, Teams settings, RSS feed service;static.vitextra.com,vitextra-storage.azureedge.net— scripts and icons of the web parts;- the Azure Application Insights ingestion endpoints of Microsoft Azure — telemetry (optional: if blocked, the web parts work without it);
- the Microsoft 365 and Microsoft Graph endpoints your tenant already uses.
Without the content delivery network the web parts cannot load. Without vitextra.com the web parts work, but the About group shows no license status and RSS Reader shows no items.
