Security & architecture
Glow Cloud Kit has no vendor data plane and no standing access. Everything runs client-side in your own Microsoft 365 tenant, as the signed-in user, on Microsoft's supported framework. The only thing that ever reaches us is a licence check.
Your content
Profiles, presence and calendars are read in the user's browser, with the user's own token, directly from Microsoft Graph. It never passes through us. Because the call is made as the user, it appears in your own Microsoft 365 audit log, and returns only what that user is already permitted to see.
What reaches us
The only data that ever leaves your tenant to us is your tenant ID and billing email, used to validate the subscription. No documents, no profiles, no calendars, no telemetry of your content. Nothing for a data-processing review.
Not an embedded widget
Many intranet add-ons - social walls, galleries, feeds - are third-party iframes or injected scripts that can load tracking on your pages and phone home per view. Glow Cloud Kit renders natively on Microsoft's framework, reads as the signed-in user, and injects no third-party script. Nothing tracks who viewed what.
Permissions manifest
Taken straight from each solution's package manifest. All scopes are delegated (run as the signed-in user) and read-only, approved by your admin in SharePoint Admin Center and revocable at any time. 9 of the 18 apps request any Microsoft Graph scope at all; the other 9 need none whatsoever, and scopes used only by an optional feature (the work-anniversaries strip) can be declined without affecting the rest of the directory.
No Microsoft Graph permissions at all. Pure client-side rendering.
No Microsoft Graph permissions at all. Pure client-side rendering.
User.Read.All Read colleague profiles (name, title, department, photo). Delegated, so it returns only what the signed-in user can already see in the organisation directory.
Presence.Read.All Show live Teams presence on people cards. Read-only; Microsoft offers no narrower scope for other people's presence.
User-LifeCycleInfo.Read.All Powers the work-anniversaries feature (a Directory toggle): reads start dates to compute upcoming anniversaries. Read-only, and declining it leaves the rest of the directory working.
Calendars.Read.Shared Read calendars the signed-in user already has access to, to combine them into one view.
Group.Read.All Resolve the Microsoft 365 group calendars the user belongs to. Read-only.
No Microsoft Graph permissions. It connects only to the social accounts you authorise directly (YouTube, Bluesky, Mastodon, RSS today; Facebook and Instagram once our Meta app review completes), read-only, and never posts.
No Microsoft Graph permissions and no admin consent. Local time comes from the browser; weather is a public Open-Meteo request.
GroupMember.Read.All Read which groups the signed-in user belongs to, so audience-targeted items appear only to the people they are meant for. It reads the signed-in user's own memberships, not other people's.
GroupMember.Read.All Read which groups the signed-in user belongs to, so audience-targeted items appear only to the people they are meant for. It reads the signed-in user's own memberships, not other people's.
GroupMember.Read.All Read which groups the signed-in user belongs to, so audience-targeted items appear only to the people they are meant for. It reads the signed-in user's own memberships, not other people's.
GroupMember.Read.All Read which groups the signed-in user belongs to, so audience-targeted items appear only to the people they are meant for. It reads the signed-in user's own memberships, not other people's.
GroupMember.Read.All Read which groups the signed-in user belongs to, so audience-targeted items appear only to the people they are meant for. It reads the signed-in user's own memberships, not other people's.
User.Read.All Read colleague profiles (name, title, department, photo). Delegated, so it returns only what the signed-in user can already see in the organisation directory.
Presence.Read.All Show live Teams presence on people cards. Read-only; Microsoft offers no narrower scope for other people's presence.
GroupMember.Read.All Read which groups the signed-in user belongs to, so audience-targeted items appear only to the people they are meant for. It reads the signed-in user's own memberships, not other people's.
No Microsoft Graph permissions at all. Pure client-side rendering.
No Microsoft Graph permissions at all. Pure client-side rendering.
No Microsoft Graph permissions at all. Pure client-side rendering.
No Microsoft Graph permissions at all. Pure client-side rendering.
No Microsoft Graph permissions at all. Pure client-side rendering.
The things that catch people out
A lot of "intranet" and web-part products either copy your tenant content to their servers or use application (app-only) Graph permissions with a vendor principal. Glow Cloud Kit does neither.
No application (app-only) permissions, ever. There is no vendor service principal that can read your tenant without a user present.
No standing access. We hold no credentials, tokens or keys into your tenant. Scopes are granted by your admin and revocable at any time.
No content store or cache. We never copy, proxy or retain your documents, profiles, calendars or any tenant content.
No DOM hacks or injected scripts. Everything runs on Microsoft's supported SharePoint Framework (SPFx), so it is upgrade-safe.
No licence keys or embedded secrets. Licensing is a signed, short-lived token bound to your tenant: activate once in the customer portal and every app licenses itself. Nothing to paste, rotate or leak.
Sub-processors
Every sub-processor we use is listed here, and none of them touches your tenant content. That is the complete picture for a vendor review.
Hosts the licence-check Worker (receives tenant ID + billing email only).
Payment processing for subscriptions (subscription + billing email). Glow Cloud Solutions is the seller; no VAT is currently charged.
Billing for subscriptions taken out before the move to Stripe, until they end.
We are not a processor of your tenant content, so there is typically nothing to assess in a DPIA beyond the licence data above. Everything runs on Microsoft's supported SPFx model, as the signed-in user, inside your own audit trail. Need a security questionnaire (CAIQ / SIG-lite) completed, or a copy of this as a one-page summary for a client review? We will turn it around fast.