SPO Scout Security & Data Handling
SPO Scout runs inside your browser, in your existing SharePoint session. Your SharePoint metadata is read, analyzed and displayed locally — it is never sent to us. The only requests that leave your browser for our servers are licence validation and the optional feedback form, and this page lists exactly what each one contains.
Accurate as of extension version 1.5.0. Reviewed September 2026.
The short version
- SharePoint analysis happens entirely in your browser. No SharePoint content or metadata is transmitted to SPO Scout servers.
- SPO Scout uses your existing Microsoft 365 sign-in. It cannot see anything your account cannot already see, and it cannot escalate its own access.
- No Entra ID app registration, no Microsoft Graph permissions, no tenant-wide admin consent.
- Our servers hold licence records only — key, tenant domain, purchaser email, status and dates.
- Payments are processed by Stripe. Card details never reach SPO Scout.
- The extension contains no analytics or usage telemetry.
How data flows
Two separate paths, which never meet. SharePoint data stays on the left. Only licence information travels on the right.
SharePoint path — stays local
- 1. You open a SharePoint site in your browser, already signed in to Microsoft 365.
- 2. SPO Scout calls the SharePoint REST API from that page, using your session.
- 3. SharePoint returns metadata your account is entitled to read.
- 4. The extension analyzes it in the browser and renders the report in the side panel.
- 5. Exports are generated in the browser and saved by your browser's download manager.
Nothing in this path reaches an SPO Scout server.
Licence path — leaves the browser
- 1. You buy Pro. Stripe collects payment and confirms it to our API by webhook.
- 2. The API issues a licence key bound to your tenant and emails it to you.
- 3. You paste the key into the extension.
- 4. The extension validates it against the licensing API and caches the result locally.
- 5. The API is hosted on Azure Functions; licence records are stored in a SharePoint list in an SPO Scout–owned Microsoft 365 tenant, reached with an Azure managed identity scoped to that one site.
Licence data only. No SharePoint content travels this path.
What SPO Scout reads
All of it through the SharePoint REST API, as your signed-in account, on the site you are looking at.
- Site collection and web details — URL, title, template
- List and library metadata — item and folder counts, settings, versioning configuration
- Site columns, content types and view definitions
- Permission assignments — role assignments, role definitions, and whether an object inherits or has unique permissions
- SharePoint and Microsoft 365 group membership visible to your account
- Sharing links published on items in the libraries you analyze
- File and folder properties — name, path, size, type, timestamps, version count
What it does not read
- The contents of your documents. SPO Scout reads file properties, never file bodies.
- Anything your signed-in account cannot already open in SharePoint.
- Sites you have not navigated to. The extension only acts on the tab you open it from.
- Non-SharePoint sites. Host permissions are limited to *.sharepoint.com and the Defender for Cloud Apps proxy domain.
- Exchange, Teams chat, OneDrive personal, or any other Microsoft 365 workload.
Every request that leaves the browser
There are three, and none of them carry SharePoint data. All go to api.sposcout.com over HTTPS.
You activate a Pro licence key, or a cached validation expires
POST https://api.sposcout.com/api/license/validate
Sends: Licence key, tenant domain, and the email address you entered if you supplied one.
You open the options page to check licence details
GET https://api.sposcout.com/api/license/status
Sends: Licence key only.
You submit the feedback form, which is always optional
POST https://api.sposcout.com/api/feedback/submit
Sends: Your message and its type, the email address you entered if you supplied one, tenant domain, licence status and key, browser version and extension version.
The feedback form is the only place you can send us free-text content, and it is entirely optional. Please do not paste confidential SharePoint data, file paths or user names into it.
What is stored, and where
On your machine
- Licence record — key, plan, expiry (chrome.storage.local)
- Cached licence validation result, so the extension is not calling out on every action
- Free-tier daily usage counter
- Action history for the reports you have run (chrome.storage.local)
- Extension settings such as theme (chrome.storage.sync, synced by your browser profile)
- Temporary CSV data held between generating a report and downloading it
On our servers
- Licence key
- Tenant domain the licence is bound to
- Purchaser email address
- Licence status, issue date and expiry date
- Validation counts, used to spot licence-sharing across tenants
- Feedback messages you choose to submit
That is the complete list. No SharePoint URLs, site names, file names, permission data or report output is stored on our side.
Browser permissions we request
These are the exact entries in the extension manifest. There are no others.
| Permission | Why it is needed |
|---|---|
| activeTab | Lets SPO Scout act on the SharePoint tab you opened it from, and only while you are using it. |
| storage | Stores your licence record, settings and recent action history on your own machine. |
| scripting | Injects the analysis script into the SharePoint page so REST calls run in your authenticated session. |
| sidePanel | Opens SPO Scout in the browser side panel so you can work beside SharePoint instead of in a popup. |
| https://*.sharepoint.com/* | Host permission for SharePoint Online. Required to read the metadata described above. |
| https://*.sharepoint.com.mcas.ms/* | Same access for tenants routed through the Microsoft Defender for Cloud Apps reverse proxy. |
Authentication and admin consent
SPO Scout does not authenticate you. Your browser is already signed in to SharePoint Online, and the extension issues its REST calls in that session. There is no second sign-in, no token for us to hold, and nothing for us to refresh.
Because of that, there is no Entra ID app registration to approve, no Microsoft Graph delegated or application permission to grant, and no tenant-wide admin consent prompt. The practical consequence is that SPO Scout can never exceed your own access: every request is subject to the same SharePoint permission checks as anything else you do in the browser.
If your organization controls which extensions users can install, an administrator can allowlist SPO Scout by extension ID through Chrome or Edge enterprise policy and deploy it centrally. Email support@sposcout.com if you need the ID or a security questionnaire completed.
Payments
Checkout is handled by Stripe. Card details are entered on Stripe's own hosted page and are never seen, handled or stored by SPO Scout. Stripe confirms a completed payment to our licensing API by signed webhook, which is what triggers licence creation and the email containing your key.
Compliance
To be direct about it: SPO Scout has not completed a SOC 2 audit, and we do not claim a certification we do not hold.
What the architecture does do is keep your SharePoint data inside your own tenant boundary, which is usually the question a security reviewer is actually asking. Teams use SPO Scout to produce evidence for their own SOC 2, HIPAA, GDPR and ISO 27001 access reviews — permission reports, sharing-link inventories and group membership exports — without routing that data through another service.
To be precise about the technical position rather than the legal one: SPO Scout servers do not receive or store the SharePoint personal data the extension analyzes. The only personal data we hold is the licence record described above. Each organization should determine its own controller and processor obligations under the privacy rules that apply to it — if your review needs a DPA covering the licence record, get in touch.
Deleting your data
- Local data: uninstalling the extension removes everything it stored in your browser — licence record, settings and action history. You can also clear action history from the extension at any time.
- Licence record: email support@sposcout.com to have it deleted. Deleting an active licence deactivates it, so Pro features stop working for that tenant.
- Feedback: tell us which submission and we will remove it.
Reporting a security issue
Send anything you find to support@sposcout.com with "Security" in the subject line. Please include reproduction steps and the extension version. We will acknowledge within two business days and keep you updated until it is resolved. Please give us a reasonable window to ship a fix before disclosing publicly — we will credit you if you would like that.
Common security questions
- Does SPO Scout need a Microsoft Entra app registration?
- No. SPO Scout has no app registration, requests no Microsoft Graph permissions and triggers no tenant-wide admin consent prompt. It calls the SharePoint REST API from the page you are already signed in to.
- Does a Global Administrator have to approve it?
- Not for the extension to function. A Global Administrator is only involved if your organization restricts which browser extensions users may install, in which case they would allowlist the extension ID through Chrome or Edge policy.
- Can SPO Scout see more than I can?
- No. Every request runs as you, in your session. SharePoint applies exactly the same permission checks it applies when you browse the site. If you cannot see an item, neither can SPO Scout.
- What happens when I uninstall?
- The browser deletes everything the extension stored locally — licence record, settings and action history. Your licence record on our side is unaffected, so you can reinstall and reactivate.
Independent product
SPO Scout is an independent product. It is not affiliated with, endorsed by or sponsored by Microsoft Corporation. SharePoint, Microsoft 365 and related trademarks belong to Microsoft.
See also the Privacy Policy, the Terms of Service and the frequently asked questions.
Reviewed it? Try it on a site you own
The free tier runs three analyses a day — enough to confirm for yourself that nothing leaves the browser. Pro is $299/year for one tenant, all admins included.