Home Security
Permissions and data
Security, permissions and data flow
Where HRPoint keeps your HR data, every Microsoft Graph permission it asks for, what leaves your tenant and why. Your HR data stays in your Microsoft 365 tenant; the licence check-in is described below.
Data flow
HRPoint runs in each person's browser, inside SharePoint or Microsoft Teams, as that person. There is no Apps 365 server between your people and your data.
-
Your people
Open HRPoint in SharePoint or Microsoft Teams. It acts with their own Microsoft 365 sign-in and permissions.
-
Your three SharePoint sites
Every record is a list item or a file on the Hub, Workspace or Records site in your tenant, read and written with SharePoint's own interface.
-
Microsoft Graph, only if approved
Optional permissions below, in your tenant, as the signed-in person. HRPoint checks at run time what is approved.
-
Outside your tenant: two calls
The public GOV.UK bank holidays feed is read with no sign-in and nothing sent. The daily licence check-in goes to Apps 365, with no names or HR records, and a site owner can switch it off. What leaves your tenant
Where your data is
Every HRPoint record is a SharePoint list item or file on three sites in your own Microsoft 365 tenant. Apps 365 Ltd does not keep a copy.
- Hub: what everyone may read, such as published policies, the leave calendar and the AI agents register.
- Workspace: one folder per person in each list, open to that person, their line manager chain and HR.
- Records: HR only, for confidential detail such as sickness detail, pay, right to work copies, recruitment records and the audit log.
Privacy comes from SharePoint permissions that the setup wizard applies: SharePoint groups (never new Microsoft Entra groups), list and folder permissions, and a permission level that lets people add records without editing history. It is privacy by configuration, not encryption: site owners and SharePoint administrators can read everything on a site, and anyone who can open a list item can read all of its columns. Files live in libraries, so your sensitivity labels, retention labels and data loss prevention policies apply to them.
HRPoint sets its HR lists not to appear in search, so they stay out of SharePoint search, Microsoft Search and Copilot answers. HRPoint Policies stays searchable; its drafts and retired policies sit in a folder only HR can open. Permission health in HRPoint shows each list's search state.
HRPoint Audit records what administrators and HR do, and only HR and administrators can open it. It is not a record of everyone: other people's actions are evidenced by SharePoint versioning and decision records.
Permissions by tier
Basic needs no Microsoft Graph permission at all. The package asks for the permissions below; asking is not granting. A Global Administrator approves each one in the SharePoint admin center, and HRPoint detects at run time what is approved instead of assuming it.
| Tier | Permission | Type | What it adds |
|---|---|---|---|
| Basic | None | The signed-in person's own SharePoint access | The record, leave, sickness, approvals, right to work, policies, reviews, hiring, reports, payroll export, AI agents and Find help. People come from the SharePoint people picker or a CSV import; email is prepared for the person to send. |
| Standard | User.Read.All | Delegated, optional | Import and refresh people from Microsoft Entra (name, job title, department, manager, start date), notice joiners and leavers, and find Microsoft Entra agent users in Add an existing agent. Shared with DirectoryPoint. Read only. |
| Messages add-on | Mail.Send | Delegated, optional | Approval emails sent from the signed-in person's own mailbox, when an administrator chooses it (otherwise HRPoint prepares the email for the person to send). It sends only and never reads a mailbox. |
| Messages add-on | Calendars.ReadWrite | Delegated, optional | Approved leave added to the person's own Outlook calendar, in their own session, when an HR admin switches it on in Settings, Outlook. Off by default. |
| Messages add-on | MailboxSettings.ReadWrite | Delegated, optional | Automatic replies on the person's own mailbox for their leave dates, in their own session, when an HR admin switches it on in Settings, Outlook. Off by default. |
Not requested by the HRPoint package: any permission that writes to Microsoft Entra (such as User.ReadWrite.All or User-LifeCycleInfo.ReadWrite.All), any Sites or Files permission, and the Shifts and People connector permissions. HRPoint reaches SharePoint in each person's own session. The optional tools below use their own permissions, on app registrations you create.
Also not requested: CopilotPackages.Read.All and AgentIdentity.Read.All. Two of the AI agents Sources need them, your Copilot catalogue and Microsoft Entra Agent ID. When an HR admin presses Look for agents, the page first checks whether its sign-in already holds the permission. If your administrators have approved it for SharePoint Framework solutions, for example for another product, the page makes one read and shows Microsoft Graph's answer. If not, it makes no request and says so in plain words. HRPoint never asks for them.
What leaves your tenant
Your HR data stays in your Microsoft 365 tenant. The HRPoint package makes two calls outside Microsoft 365, both listed here:
- GOV.UK bank holidays (www.gov.uk/bank-holidays.json): a public list, read with no sign-in and nothing about you or your organisation sent. A bundled copy is the fallback, and Settings, Leave can switch the live list off.
- The daily licence check-in to Apps 365: described in full under Licence keys and the daily check-in. It is on by default, carries no names or HR records, and a site owner can switch it off.
Nothing else: no Apps 365-hosted AI model, no analytics or tracking, and no content delivery network. Other Point apps' lists, when you also use those apps, are in your own tenant too. An optional tool you set up may do more, as the next section says.
Optional tools, outside the package
None of these is part of the HRPoint package or its Microsoft Marketplace offer, and HRPoint works fully without them. Apps 365 does not run them for you and they send nothing to Apps 365.
| Tool | Where it runs | What it needs | What it reads and writes |
|---|---|---|---|
| Power Automate templates | Your own Power Automate, on the connections of the person who owns each flow | The standard SharePoint and Microsoft Teams connectors | Read HRPoint's notification and request lists and the away calendar, and post cards. No flow writes to a list, and no card decides anything. |
| HRPoint Policies AI agent | Your organisation's Microsoft 365 Copilot | A Microsoft 365 Copilot licence for each person, and an administrator who uploads it. It asks for no permission of its own | Reads the published folder of the HRPoint Policies library with each person's own SharePoint permissions, so drafts and retired policies are not used. Web search is off. It writes nothing. |
| HRPoint Automations service | Hosting you choose, so the requests it handles pass through that host | An app registration you create and consent to, with the delegated SharePoint permission AllSites.Write; it acts only as the signed-in person | Stores no HR data. Reads that person's own leave and the away calendar. Its one write is a leave request the person confirmed, kept as ready to send until they send it in HRPoint. |
| People connector | An administrator's computer. A dry run unless told to write | An app registration you create and consent to: AllSites.Read (SharePoint); to write, ExternalConnection.ReadWrite.OwnedBy and ExternalItem.ReadWrite.OwnedBy | Reads HRPoint People and no other list. Publishes job title, department and place of work (and, if you choose, name and work email) to Microsoft 365 people data, which Microsoft makes visible to everyone in your organisation and stores in each person's Microsoft 365 profile. |
| Shifts mirror | An administrator's computer. A dry run unless told to write | An app registration you create and consent to: Schedule.Read.All, to write Schedule.ReadWrite.All, and AllSites.Read (SharePoint) | Reads HRPoint People and the away calendar. Writes time off into the Shifts schedules you name: dates only, never the type of leave or a reason. |
| Entra sync admin tool | An administrator's computer. A dry run unless told to write | An app registration you create and consent to: User.Read.All and User-LifeCycleInfo.Read.All; to write, User.ReadWrite.All and User-LifeCycleInfo.ReadWrite.All | Writes start and leaving dates, employee ID and type, department, job title and manager from HRPoint to cloud-mastered Microsoft Entra accounts, never synced accounts or guests, and logs every change. |
Licence keys and the daily check-in
Licence keys are signed by Apps 365 and checked inside your tenant, in the browser, with no call to us. HRPoint never shows a saved key again.
Separately, at most once a day from each browser, HRPoint sends the Apps 365 Licence Manager (licences.apps365.pro) your tenant ID, the addresses of the HRPoint site and its site collection, the app version, the licence state and plan, and the licence ID. It never sends names, HR records, profiles or keys. A site owner can switch the check-in off in HRPoint's settings, under Licence; keys keep working without it. Details are in the privacy notice.
AI
HRPoint has no AI model of its own and sends nothing to one. Find help for a task is a search over the tasks, skills, certificates and availability you record, and Ask a question matches words to HRPoint's own reports with no model. AI drafts come from HRPoint's own templates or, when a person chooses Draft with Copilot, are copied by that person into your organisation's Microsoft 365 Copilot. Every AI agent and AI draft is labelled, a person decides, and HRPoint never scores or ranks people.
This website
hrpoint.app loads no third-party scripts, fonts or trackers, runs no scripts at all and sets no cookies. Every page has a strict Content Security Policy, HTTPS with HSTS, and no framing.
Reporting a security problem
Email info@apps365ltd.com, or see security.txt. Please do not test against other organisations' data.