SecretaryBot

Publisher Attestation: The information on this page is based on a self-assessment report provided by the app developer on the security, compliance, and data handling practices followed by this app. Microsoft makes no guarantees regarding the accuracy of the information.

Last updated by the developer on: April 29, 2019

General information

Information provided by MySecretary to Microsoft:

Information Response
App name SecretaryBot
ID 256ff1bc-fd16-4f82-aeb3-8a6977ff2ec4
Capabilities Bot, Tab
Office 365 clients supported Microsoft Teams
Partner company name MySecretary
Physical address None
Contact information for this app masota@morehour.com
URL of partner website https://secretarybot.wordpress.com/
URL of Teams application info page https://secretarybot.wordpress.com/faq/
URL of Privacy Policy https://secretarybot.wordpress.com/privacy-policy/
URL of Terms of Use https://secretarybot.wordpress.com/terms-of-use/
Main telephone number None
Description of available licensing options, if any Free
Licensing contact Support@morehour.com
Licensing telephone number N/A

Feedback

Questions or updates to any of the information you see here? Contact us!

How the app handles data

Information provided by MySecretary on how this app collects and stores organizational data, and what control an organization has over this data.

Data access using Microsoft Graph

List any Microsoft Graph permissions this app requires, and for each, whether they are delegate or application permissions, the justification and purpose for this permission (what does the app use this information for?), and whether the app stores any of this information in its databases.

Permission Delegated/Application Justification/Purpose Is any of this data stored in app database(s)? Azure AD App ID
People.Read Delegated Try to find colleagues who have strong relationships with user.
Calendars.ReadWrite Delegated Send meeting request instead of user.
MailboxSettings.Read Delegated Fetch user's language and timezone setting. Store language for showing correct langage. Save timezone to call MS Graph calendar API correctly
openid Delegated For OpenID authentication.
User.Read Delegated Try to find user's country and preferred language. It's used for backup for MailboxSettings.Read. Store username, city, country and langauge for user analytics. Store email for contacting customer. We have never used email address, but may use for support.
profile Delegated Getting user name and OID. Try to use OID for connecting Outlook Addin in the future. Save OID for identifying user's unique id in the MS identity system.
Calendars.Read.Shared Delegated Fetch user's and their colleagues' free time information.
email Delegated For storing email. See above.

Data access via bots

If this app contains a bot or a messaging extension, it can access the roster (first name, last name, display name, email address) of any team member in a team or chat it's added to. Does this app make use of this capability?

Access team/chat roster? Justification/Purpose Is any of this data stored in app database(s)?
Team Use this infromation to schedule team meeting

Telemetry data

Does any organizational information, including EUII (end-user identifiable information) and OII (organizational identifiable information), appears in this application's telemetry/logs? If yes, describe what data is present and what controls/processes an organization has in place to archive and/or delete it. If no, describe the controls/processes in place to prevent EUII and OII from appearing in telemetry/logs.

Not specified.

Storing and securing organizational data

Describe where/how is this application's data is stored and how access to it is controlled. Is it encrypted? Who can access it? How do you ensure that only authorized systems/individuals can access it? Examples: 2FA for all admins, Privileged Access Management (PMA), partitioning service admin accounts from Azure AD/corporate user accounts, protected IP ranges between systems, etc.

We store users' data in Microsoft Azure SQL Database. It is encrypted by SQL Database Transparent data encryption. Limited engineers can access it with Azure AD authentication.

Organizational controls for data stored by partner

Describe any capabilities an organization's administrators have to control their information residing in partner systems, e.g. deletion, retention, auditing, archiving, end-user policy, etc.

We don't provide adminstrative control to end users yet, but if end users request us to delete data, we can follow their request.

Human review of organizational information

Are humans involved in reviewing or analyzing any organizational data that is collected or stored by this app?

Not specified.

Feedback

Questions or updates to any of the information you see here? Contact us!

Information from the Microsoft Cloud App Security catalog appears below.

Note

The information on this page is based on a self-attestation report provided by the app developer on the security, compliance and data handling practices followed by the app. Microsoft makes no guarantees regarding the accuracy of the information. Contact us if you believe information about an app is outdated.

View in a new tab

Feedback

Questions or updates to any of the information you see here? Contact us!