Lucidchart Diagrams for PowerPoint

Publisher Attestation: The information on this page is based on a self-assessment report provided by the app developer on the security, compliance, and data handling practices followed by this app. Microsoft makes no guarantees regarding the accuracy of the information.

Last updated by the developer on: October 31, 2019

General information

Information provided by Lucid Software Inc to Microsoft:

Information Response
App name Lucidchart Diagrams for PowerPoint
ID WA104380117
Office 365 clients supported PowerPoint 2013 Service Pack 1 or later, PowerPoint 2016 for Mac
Partner company name Lucid Software Inc
Physical address 10355 S. Jordan Gateway, Suite 150, South Jordan, UT 84095
Contact information for this app Joseph McFarlane, josephmcfarlane@lucidchart.com
URL of partner website https://www.lucidchart.com/
URL of Teams application info page https://lucidchart.zendesk.com/
URL of Privacy Policy https://www.lucidchart.com/pages/privacy
URL of Terms of Use https://go.microsoft.com/fwlink/?LinkID=521715&omkt=en
Main telephone number (888) 875-1867
Description of available licensing options, if any Individual named users, starting with the quantity of 3
Licensing contact sales@lucidchart.com
Licensing telephone number (888) 875-1867

Feedback

Questions or updates to any of the information you see here? Contact us!

How the app handles data

Information provided by Lucid Software Inc on how this app collects and stores organizational data, and what control an organization has over this data.

Data access using Microsoft Graph

List any Microsoft Graph permissions this app requires, and for each, whether they are delegate or application permissions, the justification and purpose for this permission (what does the app use this information for?), and whether the app stores any of this information in its databases.

Permission Delegated/Application Justification/Purpose Is any of this data stored in app database(s)? Azure AD App ID
email Delegated The email, openid, and profile permissions enable Lucidchart to generate an openid token for a user and get enough basic info about the user to register a Lucidchart account for them if necessary. In order to verify the data that comes back from Microsoft, we make a request to get the public key that their response is signed with. No other data is received from or sent to Microsoft as part of our SSO flow. Name and email address.
openid Delegated The email, openid, and profile permissions enable Lucidchart to generate an openid token for a user and get enough basic info about the user to register a Lucidchart account for them if necessary. In order to verify the data that comes back from Microsoft, we make a request to get the public key that their response is signed with. No other data is received from or sent to Microsoft as part of our SSO flow. Name and email address.
profile Delegated The email, openid, and profile permissions enable Lucidchart to generate an openid token for a user and get enough basic info about the user to register a Lucidchart account for them if necessary. In order to verify the data that comes back from Microsoft, we make a request to get the public key that their response is signed with. No other data is received from or sent to Microsoft as part of our SSO flow. Name and email address.

Data access using other Microsoft APIs

Apps and add-ins built on Microsoft 365 may use additional Microsoft APIs other than Microsoft Graph to collect or process organizational information. List any Microsoft APIs other than Microsoft Graph this app uses, and for each, the justification and purpose (what does the app use this information for?), and whether the app stores any of this information in its databases.

Microsoft API Justification/Purpose Is any of this data stored in app database(s)?
JavaScript API for Office We use the Office OneDrive javascript SDK from to open the OneDrive file chooser using OneDrive.open(). We do not generate any access tokens and we do not make any requests to OneDrive's APIs ourselves; the OneDrive file chooser SDK does that for us. We only see the filenames that the user chooses. If the user selects a file using the OneDrive file chooser, we store the filename.

Non-Microsoft Services Used

If the app transfers or shares organizational data with non-Microsoft service(s), list the non-Microsoft service(s) the app uses, what data is transferred, and include a justification for why the app needs to transfer this information.

Lucidchart data is stored in AWS.

Data access via bots

If this app contains a bot or a messaging extension, it can access the roster (first name, last name, display name, email address) of any team member in a team or chat it's added to. Does this app make use of this capability?

Access team/chat roster? Justification/Purpose Is any of this data stored in app database(s)?
N/A N/A N/A

Add-in Data Access

List the permissions this app requires for accessing your organization's data, the justification and purpose for this permission (what does the app use this information for?), and whether the app stores any of this information in its databases.

Permission Description
Write Document Can make or suggest changes to your document
Send Data Can send data over the Internet

Telemetry data

Does any organizational information, including EUII (end-user identifiable information) and OII (organizational identifiable information), appears in this application's telemetry/logs? If yes, describe what data is present and what controls/processes an organization has in place to archive and/or delete it. If no, describe the controls/processes in place to prevent EUII and OII from appearing in telemetry/logs.

We log email and IP addresses for security and support reasons. All access to logs is recorded & logs are actually unchangeable in a third party system. Access to logs requires MFA.

Storing and securing organizational data

Describe where/how is this application's data is stored and how access to it is controlled. Is it encrypted? Who can access it? How do you ensure that only authorized systems/individuals can access it? Examples: 2FA for all admins, Privileged Access Management (PMA), partitioning service admin accounts from Azure AD/corporate user accounts, protected IP ranges between systems, etc.

Lucidchart's Admin controls are described here: https://lucidchart.zendesk.com/hc/en-us/articles/115004081086-Admin-Panel

Organizational controls for data stored by partner

Describe any capabilities an organization's administrators have to control their information residing in partner systems, e.g. deletion, retention, auditing, archiving, end-user policy, etc.

Lucidchart data is stored in AWS. It is encrypted at rest and in transit. Lucidchart uses the rules of least privilege and MFA.

Human review of organizational information

Are humans involved in reviewing or analyzing any organizational data that is collected or stored by this app?

No

Feedback

Questions or updates to any of the information you see here? Contact us!

Information from the Microsoft Cloud App Security catalog appears below.

Note

The information on this page is based on a self-attestation report provided by the app developer on the security, compliance and data handling practices followed by the app. Microsoft makes no guarantees regarding the accuracy of the information. Contact us if you believe information about an app is outdated.

View in a new tab

Feedback

Questions or updates to any of the information you see here? Contact us!