Security

1Summary

2Architecture and data flow

The product is an Excel task-pane add-in plus a backend we operate on Azure. No party other than ourselves and Microsoft sits in the data path.

The workbook file is never uploaded. Only the ranges a tool needs to read are transmitted.

3What is stored, and what is not

Operational records hold status, timestamps, account id, counts, exception reasons, log lines and model token counts. Result cell values are excluded, and exception messages are redacted before durable write so that a rejected value cannot leak into history. Upload records hold filename, size and account — never file contents.

4Access control

Customer side

• Every request carries a signed bearer token with an account id embedded; the signature detects tampering.
• File and template access is scoped to that account. One account cannot list, download or delete another's uploads.
• Tokens are issued per member and individually revocable; revocation is applied from the operations console.
• The token is embedded in the add-in's manifest, so treat manifest files as credentials. If one leaks, revoking that single token contains the exposure.

Our side

• The operations console uses a separate credential from any customer token, with signed, expiring sessions. Customer tokens are never accepted there.
• It exposes job status, counts, exception reasons, uploaded filenames and the member directory. It has no route to read uploaded file contents or result cell values.
• Azure credentials live only as container secrets, never in the browser.
• Administrative rights over the Azure resources are limited to the minimum set of operators.

5Isolation

• Uploads and template settings are separated by account-scoped paths in storage.
• Each contracted organisation gets its own containers and its own storage account. No customer data is shared between stacks.
• Promoting a release copies container images and our own template packs only. Customer uploads, settings and operational records never move between environments.
• Template packs are format definitions we author. They contain no customer product data.

6Transport and application hardening

• HTTPS everywhere; the pane refuses to bootstrap from a non-HTTPS gateway URL.
• A Content-Security-Policy confines the pane's network access to our serving origin and the Office script host. No third-party scripts load — we block even Office's own telemetry frame.
• All assets, fonts included, are self-hosted. No external font service or CDN is contacted.
• Uploads are stored content-addressed by hash, with a path-traversal guard on static serving.
• Model-authored analysis code runs in a separate subprocess under a timeout and a memory cap. This is process isolation, not a hardened multi-tenant sandbox — which is why only documents you explicitly upload are ever routed through it.

7How we use AI

• We do not train or tune models on your data.
• Under Microsoft's published Azure OpenAI terms, your prompts and completions are not used to train OpenAI or Microsoft foundation models.
• Microsoft's standard terms permit abuse-monitoring retention of prompts and completions for up to 30 days within the resource's geography, reviewed by authorised Microsoft personnel only where abuse is flagged. We intend to apply for Modified Abuse Monitoring, which removes this; this page will be revised if approved.
• If web search is used, the query text — typically a product name or model number — reaches Azure OpenAI and its search index. Workbook contents are not sent.

8Availability

• The service runs on Azure managed services; platform availability follows Microsoft's SLA.
• Maintenance may cause brief interruptions. We give advance notice where impact is expected.
• Uploads and template settings are protected by Azure Blob Storage redundancy. Fill results live in memory by design, so recovery after a fault means re-running the job.

9Reporting a vulnerability

If you find a vulnerability, suspicious behaviour, or evidence of a leak, please tell us.

When testing, please do not access real customer data, degrade the service, or disclose findings publicly before we have had a chance to fix them.

10Keeping this current

Any change to the data flows described here is made in the same change that revises this page and the Privacy Policy — in particular: enabling extraction caching, altering retention rules, or adding any third-party service to the data path.

End of document.