Your permissions, nothing more
Every read and every fix goes through SharePoint in the person's own context. ExposurePoint can only see and change what that person already can. It has no service account and no extra rights.
Privacy and permissions
It runs in your tenant, as you, and keeps what it finds there.
ExposurePoint has no server and asks for no API permissions. It works through SharePoint with the signed-in person's own rights, and the only thing it ever sends us is a small, switchable licence check-in.
No API permissions to approve
The package requests no Microsoft Graph permissions, so there is nothing for an administrator to approve in API access. Uploading it to the app catalog is the only admin step.
Names and permissions, never contents
It reads who can open what: permissions, links, groups, owners, dates and label status. It never opens or reads what is inside your files.
Nothing changes until you confirm
Fixes are offered only to people who can manage the site, and each one shows what will change and who will lose access first. Fixes only ever take access away; files locked down tighter than the site are never touched.
History in your own site
Scores are saved to a hidden list on your SharePoint site. Hidden means out of the site navigation; it is not a security boundary, and the list follows your site's own permissions.
Nothing loaded from outside
Every script, style and icon ships inside the package. It loads nothing from other websites, which keeps it working under SharePoint's content security rules.
The one thing it sends
A small daily licence check-in, which a site owner can switch off.
Licence keys are checked on the device; there is no licence server for the app to call. Separately, once a day per site, it tells Apps 365 a few facts so we can support your licence.
| Sent | Never sent |
|---|---|
| Microsoft 365 tenant ID | Names or email addresses |
| Site and site collection address | File, folder or link details |
| App version | Findings or scores |
| Licence state, plan and key IDs | Licence keys themselves |
Switch it off in the web part settings under Licence. ExposurePoint works exactly the same without it. Details in our privacy notice.
Limits
What it does not do.
- It checks one site at a time. It is not a tenant-wide governance scan; that is GovernPoint.
- It does not judge sensitivity. It reports a missing sensitivity label; deciding what content is sensitive needs Microsoft Purview.
- It does not make a site secure or compliant. It lowers exposure to Copilot and shows you the evidence.
- It does not change tenant settings. Default sharing settings, owners for ownerless sites and labels are left to your administrator, and the report says what to ask for.