ShortPoint Software Data Protection and Privacy

At ShortPoint, the privacy and security of our customersʼ data is our priority. This article tackles the safety and security practices we use at ShortPoint to integrate our design features into your environment without getting any information from it.

TABLE OF CONTENTS

• Security at ShortPoint
• What changes can you expect after you install ShortPoint SPFx?
• Does the ShortPoint SPFx app have access to the data on my environment?
• What types of data does ShortPoint collect?
• How is the Usage Information being sent?
• Can I disable sending usage data completely?
• How long does ShortPoint keep my data?
• How is security ensured and maintained at ShortPoint?
• Is ShortPoint reliable?
• Need further assistance?

Security at ShortPoint

Learn firsthand from Yana Li, our Senior Manager of Information Security and Compliance, how we ensure all our products are designed with privacy and security in mind.

What changes can you expect after you install ShortPoint SPFx?

Here is what you can expect after you Install ShortPoint SPFx into Office 365: 

• The app will appear in the list of installed apps in the Tenant App Catalog.

• Two new items will appear in the Site Contents of the site where you installed ShortPoint: 
  • ShortPoint SPFx Dashboard
  • ShortPoint SPFx

These new items will not appear on other sites except the one where the initial installation of ShortPoint was made until you decide to add ShortPoint to more sites.

• The ShortPoint web part icon will become available in the list of available web parts that you can add while editing a Modern SharePoint Site Page.

• If you use install ShortPoint in a Classic SharePoint Page, you will see a Plus icon in edit mode.

Other than these changes, there will be nothing else that appears in your environment after installing ShortPoint SPFx. No existing page designs will be affected. ShortPoint will not change lists, libraries, systems, or content pages in your environment, as well as affect the existing look and feel (branding) of your Intranet after installation.

Does the ShortPoint SPFx app have access to the data on my environment?

When you install ShortPoint on your environment, it will run entirely on your sites. ShortPoint does not access, edit, or store your data.

Below, we will explore how ShortPoint works in an Office 365 environment:

• ShortPoint is installed entirely in your environment.

ShortPoint uses the SharePoint Framework (SPFx) development model which supports client-side SharePoint development and integration with SharePoint data. It is also referred to as a full trust client-side solution. By its nature, it contains full trust client-side code and can run in full trust.

All scripts are executed within the safety of your SharePoint environment and we do not have access to your content by any means. We also set further security features to ensure that all data and information are safe at all times.

• ShortPoint operates by adding code to the page content.

For example, when you insert a ShortPoint Design Element to a page, it adds a code (ShortPoint plain text markup language) to the page content. When the page is loaded, the ShortPoint JavaScript engine will convert the ShortPoint code with the latest UI markup. The rest will be handled by the browser's JavaScript engine.

• ShortPoint does not create any new master or content pages.

ShortPoint saves a plain text code in the page content. ShortPoint works and integrates seamlessly with Microsoft SharePoint authoring features. It does not create any new master pages, page layouts, or other pages. ShortPoint works with SharePoint OOTB master pages, page layouts, content editor web parts, and page content fields.

What types of data does ShortPoint collect?

ShortPoint only collects:

• ShortPoint License Activation and Protection information which includes:
  • First Name
  • Last Name
  • Business Email
  • Direct Phone
  • Country
  • Job Title
  • Company Name
  • Company Type
  • Environment
  • Tenant URL
  • Number of ShortPoint Editors

• Product usage numbers / Usage Information which includes:
• ShortPoint Users Information (email, name, and all available profile properties);
• ShortPoint License information used for the activation;
• Browser information for debugging and support;
• Current Page URL;
• ShortPoint version;
• ShortPoint package type (WSP Solution, Add-in, SPFx);
• Environment ID and type (Office 365, SharePoint 2019, SharePoint 2016, SharePoint 2013);
• Counters' data on how many times the ShortPoint User:
  • Opened the Page Builder
  • Inserted the ShortPoint Design Element and what that Design Element was
  • Opened the Theme Builder
  • Used the Power BI
  • Installed ShortPoint, and the site URL where it was installed
  • Uninstalled ShortPoint, and the site URL where it was uninstalled

NOTE: For the full list of usage information collected by the ShortPoint software, you may contact privacy@shortpoint.com.

How is the Usage Information being sent?

• ShortPoint calls our highly secure and protected activation.shortpoint.com/api, using the secure channel HTTPS.
• The Event properties object is serialized as JSON, encoded to Base64, and sent as a formed body.
• Events are sent only while editing the pages. Nothing is sent while the users are viewing the pages.

Can I disable sending usage data completely?

Yes, we still grant our customers the ability to deny product usage data collection. You can block access to the activation.shortpoint.com domain.

When activation.shortpoint.com is blocked, the following changes will occur:

• Customers will remain on the latest version of the app and cannot disable automatic upgrades
• Automatic license updates and user license assignments will not function
• The following Design Elements will stop working
  • Teams
  • Power Apps
  • Power BI
• The following Connections will stop working
  • Shared Events (Outlook)
  • My Events (Outlook)
  • Group Events (Outlook)

For SharePoint Online: After activating a license and blocking the activation.shortpoint.com domain, the app will continue working on previously installed sites. However, you won't be able to install the app on new sites while the domain is blocked. You will need to unblock the domain when applying licenses or modifying ShortPoint user assignments.

How long does ShortPoint keep my data?

ShortPoint keeps your data for at least three years. However, we respect your privacy, and you can request to delete all your data from our systems at any time. You may send this request to privacy@shortpoint.com.

How is security ensured and maintained at ShortPoint?

At ShortPoint, security is a foundational priority integrated into our people, processes, and technology. We maintain continuous monitoring of over 140 internal security controls to ensure ongoing alignment with industry-leading practices and evolving compliance requirements. Our security policies and procedures are reviewed annually, formally approved by management, and communicated to all employees to foster a strong security-first culture across the organization.

All product features and functionality undergo review by our internal Security Committee to identify and mitigate potential risks early in the development lifecycle. We enforce mandatory security code reviews for every change, ensuring that security is not an afterthought but a built-in part of our development process.

To strengthen our security and compliance posture, we leverage Drata for real-time automation and continuous monitoring of our security controls. ShortPoint undergoes independent third-party audits on a regular basis and has successfully completed both a SOC 2 Type II and a SOC 3 examination. These reports demonstrate that our systems and practices have been independently assessed against the AICPA’s Trust Services Criteria for security, availability, and confidentiality—providing assurance to our customers and stakeholders about the design and operating effectiveness of our controls.

NOTE: To check and see the SOC 2 Type 2 Report, you may send a request here. 

Is ShortPoint reliable?

Here are some of the methods we implement to ensure that ShortPoint is reliable:

• Night Watch Testing

We run daily end-to-end automated testing to detect any change that may affect ShortPoint product performance, allowing us to effectively catch any requirements for updates and fixes in record time.

• Upgrade Control

We have features that provide you with control over when and how your sites are upgraded. ShortPoint upgrades are seamless and efficient with no downtime, and no changes affecting your existing sites and designs.

• SandBox Mode allows you to test new releases in a secure environment where you can view changes or improvements that are implemented and test them without affecting published pages.
• One Click upgrade allows you to push a ShortPoint upgrade to all site collections within your tenancy at once from a single location with just one simple click.
• Auto Upgrade allows you to be automatically upgraded to the latest ShortPoint version upon every public release.

• Live Status Updates

We provide real-time updates about potential service outages on our Live Status dashboard. Any user can access it at any point in time to check the operation of all ShortPoint services. Also, we send email notifications to subscribed individuals.

• ShortPoint Designs Stay with You

Our designs are entirely saved within your page. If you remove ShortPoint completely, your designs will still be saved. If your computer crashes while you are designing, your work will be auto-saved. However, they may still be cases where your designs may not be saved due to unexpected errors caused by the computer crash.

Need further assistance?

You can check out our Security Page and our ShortPoint Privacy Policy for more information about our Data Protection and Privacy. You can also reach out to our security team at security@shortpoint.com.