Security and compliance dossier

The short version

The package, field by field

These values come straight from the package you can download. You can match every one of them against what your App Catalog shows you.

The version you approve is the version that keeps running. Because the package is an engine and not a generator, your team can publish fifty components without a single new deployment, a single new permission or a single new ticket for you. What changes is the configuration, never the code.

The one permission — and everything it is not

The direction of this permission is the part most people read backwards, so it is worth being precise: the token is issued towards Sharelio's API, not towards your data.

The web part, running inside your tenant, asks Entra ID for a token addressed to Sharelio, and presents it to us so we can tell which organisation is asking. We verify the signature, the audience, the issuer and the tenant id against Microsoft's public keys, and return the configuration of the components that same tenant published. It buys us no access to anything of yours.

Permissions Sharelio does not request

This is not a promise about our roadmap that you have to take on trust — it is checkable today: the package declares its permission requests in the manifest, your App Catalog shows you the complete list before you approve, and any request we added later would appear there as a new pending approval that only you can grant.

Sharelio has no identity inside your SharePoint

Sharelio does write in your tenant — it can create the list a tool needs, and its components can open SharePoint's own new-item form. So the guarantee we offer is not the weak one (“we don't write”) but this stronger one:

Everything Sharelio does inside your SharePoint, it does as the person sitting in front of the screen, with their permissions. There is no service account, no application identity and no privilege of ours to escalate.

• Reads. List rows are read by the browser with the employee's own SharePoint session. Someone who cannot open a list will not see it through Sharelio either — and the rows never travel to us.
• Writes. List provisioning runs with that same session, scoped to the current site. If the person cannot create lists there, neither can Sharelio: SharePoint says no exactly as it would if they had tried by hand.
• Never by surprise. The full set of columns is shown and a button has to be pressed. It only happens in page edit mode; someone merely viewing a page never triggers a write.
• Never destructive. An existing list is reused, missing columns are added, and a column with the same name and a different type stops the operation with a warning — nothing is converted or overwritten.

If you want to rule writes out entirely, you do not need to uninstall anything: withhold edit permissions on the site. Without them nobody can place a web part, and without placing one there is nothing to create.

What leaves your tenant, and what never does

What the AI sees

Components are generated by a large language model, so it is fair to ask exactly what reaches it. The description your colleague writes, and the names of lists and columns. Never the rows.

The model does not have, and could not have, access to your data: generation happens in our backend, which never holds your list contents in the first place. The output is not code either — it is a JSON configuration validated against a closed schema before it is stored, and rejected outright if it does not fit.

• Provider: Anthropic (claude-sonnet-5), via its commercial API.
• Training: under Anthropic's commercial API terms, data submitted through the API is not used to train models.
• Determinism: whatever the model returns, only what the schema allows can ever be stored or rendered. The schema is the boundary, not the prompt.

Subprocessors

Every provider that processes data on our behalf, under a data processing agreement. We do not sell or share data with anyone else.

Where a provider processes data outside the European Economic Area, the transfer is covered by the European Commission's Standard Contractual Clauses.

What we keep, and for how long

To request access, export or deletion, write to hello@sharelio.com. We reply within 30 days.

How to verify all of this yourself

Nothing on this page asks for your trust. All of it is checkable before you approve anything, and without a Sharelio account.

1. Download the package. sharelio-host.sppkg — no registration, no login.
2. Check its integrity. The SHA-256 we published is at sharelio-host.sppkg.sha256. On Windows: Get-FileHash sharelio-host.sppkg -Algorithm SHA256. On macOS or Linux: shasum -a 256 sharelio-host.sppkg.
3. Open it. A .sppkg is a zip. Rename it and unzip it: the manifests carry the ids in the table above and the permission request, and the client-side assets carry the JavaScript that will run.
4. Read the permission request in your own catalog. Upload the package to your App Catalog and look at API access before approving. The list you see there is the complete one — nothing can be requested later without appearing as a new pending approval.
5. Ask us for the schema. The JSON schema that bounds what a component may describe is available on request at hello@sharelio.com. It is closed: no code, no evaluable expressions, no HTML, no arbitrary URLs.

What we do not have yet

A dossier that only lists strengths is not a dossier. Sharelio is a young company, and these are the gaps you would find anyway:

• No ISO 27001 or SOC 2 certification of our own. Our infrastructure providers hold theirs; we do not yet hold ours, and we will not imply otherwise.
• No independent penetration test published. If your process requires one, tell us and let's talk about scope.
• No 24/7 support commitment outside an Enterprise agreement.

What we offer instead is the thing certifications are a proxy for: a surface small enough to audit in an afternoon. One package, one read-only delegated permission, no Graph access, no custody of your data, and an uninstall that leaves your lists exactly as they were.

Removing it

• Remove the permission: SharePoint admin center → Advanced → API access → select Sharelio → Remove.
• Retire the package: delete it from the App Catalog.

Components stop rendering immediately. Your lists and their data are untouched, because they never left your tenant. To switch off a single component instead, no IT involvement is needed: it can be disabled centrally from Sharelio's governance panel.