AtBot

Publisher Attestation: The information on this page is based on a self-assessment report provided by the app developer on the security, compliance, and data handling practices followed by this app. Microsoft makes no guarantees regarding the accuracy of the information.

Last updated by the developer on: April 29, 2019

General information

Information provided by H3 Solutions, Inc. to Microsoft:

Information Response
App name AtBot
ID 7c01af81-ae7d-416e-98a3-c139cae8cfb0
Capabilities Bot
Office 365 clients supported Microsoft Teams
Partner company name H3 Solutions, Inc.
Physical address 10432 Balls Ford Rd. STE 230 Manassas, VA 20109
Contact information for this app hello@atbot.io
URL of partner website https://atbot.io
URL of Teams application info page https://admin.atbot.io/Docs/GettingStarted
URL of Privacy Policy https://admin.atbot.io/privacy
URL of Terms of Use https://admin.atbot.io/terms
Main telephone number 1 (855) 464-5914
Description of available licensing options, if any Free, Pro, Enterprise \ https://admin.atbot.io/Docs/BizzyTiers
Licensing contact support@atbot.io
Licensing telephone number 1 (855) 464-5914

Feedback

Questions or updates to any of the information you see here? Contact us!

How the app handles data

Information provided by H3 Solutions, Inc. on how this app collects and stores organizational data, and what control an organization has over this data.

Data access using Microsoft Graph

List any Microsoft Graph permissions this app requires, and for each, whether they are delegate or application permissions, the justification and purpose for this permission (what does the app use this information for?), and whether the app stores any of this information in its databases.

Permission Delegated/Application Justification/Purpose Is any of this data stored in app database(s)? Azure AD App ID
openid Delegated Allows users to log in. No 066a6b3a-f7a0-450a-98c7-34db1da31600
User.Read Delegated Gives us access to the user’s Tenant ID and UPN to allow us to tie Flows/Logic Apps created to the users that created them. Tenant ID, UPN 066a6b3a-f7a0-450a-98c7-34db1da31597
offline_access Delegated Allows us to use a refresh token to keep users logged in. Access/Refresh tokens. 066a6b3a-f7a0-450a-98c7-34db1da31599
email Delegated Gives us access to the user's email address. No 066a6b3a-f7a0-450a-98c7-34db1da31598
Directory.Read.All Delegated Enumerate AAD groups to allow security trimming of bot skills. Enumerate users to be able to apply licenses. Enumerate users to add as Administrators/Contributors AAD Group Name, AAD Group GUID, UPN 066a6b3a-f7a0-450a-98c7-34db1da31594
People.Read Delegated Enumerate people in a Get Person action from Flow. Allows the bot to retrieve people from the /People endpoint in Microsoft Graph. No 066a6b3a-f7a0-450a-98c7-34db1da31596
profile Delegated Access to user's UPN. UPN 066a6b3a-f7a0-450a-98c7-34db1da31601
Directory.Read.All Application Enumerate AAD groups to allow security trimming of bot skills. Enumerate users to be able to apply licenses. Enumerate users to add as Administrators/Contributors AAD Group Name, AAD Group GUID, UPN 066a6b3a-f7a0-450a-98c7-34db1da31595

Data access via bots

If this app contains a bot or a messaging extension, it can access the roster (first name, last name, display name, email address) of any team member in a team or chat it's added to. Does this app make use of this capability?

Access team/chat roster? Justification/Purpose Is any of this data stored in app database(s)?
Yes The creation of mentions in bot-generated chat messages No

Telemetry data

Does any organizational information, including EUII (end-user identifiable information) and OII (organizational identifiable information), appears in this application's telemetry/logs? If yes, describe what data is present and what controls/processes an organization has in place to archive and/or delete it. If no, describe the controls/processes in place to prevent EUII and OII from appearing in telemetry/logs.

Tenant ID, UPN We use Application Insights and our logs will last for 90 days before being automatically archived. (https://docs.microsoft.com/azure/azure-monitor/app/data-retention-privacy)

Storing and securing organizational data

Describe where/how is this application's data is stored and how access to it is controlled. Is it encrypted? Who can access it? How do you ensure that only authorized systems/individuals can access it? Examples: 2FA for all admins, Privileged Access Management (PMA), partitioning service admin accounts from Azure AD/corporate user accounts, protected IP ranges between systems, etc.

All AtBot Web Applications, Databases, Caching and Storage resources are located in a subscription that is not connected to our company AAD with only Administrators who have access to the resources. 2FA is required for these administrators. All databases are encrypted and firewalled to only allow Azure IPs and our corporate office in Manassas, VA.

Organizational controls for data stored by partner

Describe any capabilities an organization's administrators have to control their information residing in partner systems, e.g. deletion, retention, auditing, archiving, end-user policy, etc.

Administrators have the ability to delete bot configurations that may contain AAD Group Names/GUIDs. Upon cancellation of service, all UPNs will be removed from the licensing database. See 'Azure Services' under Data Residency. Much of the customer-specific data produced via the use of AtBot is stored in the customer's tenant and so admins of that tenant have full control of the data there.

Human review of organizational information

Are humans involved in reviewing or analyzing any organizational data that is collected or stored by this app?

Not specified.

Feedback

Questions or updates to any of the information you see here? Contact us!

Information from the Microsoft Cloud App Security catalog appears below.

Note

The information on this page is based on a self-attestation report provided by the app developer on the security, compliance and data handling practices followed by the app. Microsoft makes no guarantees regarding the accuracy of the information. Contact us if you believe information about an app is outdated.

View in a new tab

Feedback

Questions or updates to any of the information you see here? Contact us!