Security and data
Series Attendance Roster uses delegated, read-only Microsoft Graph permissions. It never writes to Microsoft 365.
| Permission | Used for |
|---|---|
User.Read | Your name and e-mail address (sign-in, monthly e-mail). |
Calendars.ReadBasic | Find your recurring meetings and their dates and join links (no bodies or attachments). |
OnlineMeetings.Read | Look up the Teams meeting behind a join link. |
OnlineMeetingArtifact.Read.All | Read the attendance reports of meetings you organize (Microsoft returns them only to the organizer). |
offline_access | Keep archiving after you close the browser (refresh token). |
- Sign-in: Microsoft identity platform, authorization code with PKCE; personal Microsoft accounts are rejected.
- Tokens and personal data encrypted with AES-256-GCM (separate keys); keys live only in the hosting provider's secret store.
- Logs contain ids, counts and error codes only.
- Exports: Excel cells are written as text (never formulas); CSV cells that could start a formula are prefixed with an apostrophe, also for semicolon locales.
- E-mailed download links are signed, expire after 14 days and can all be revoked in Settings.
- Retention chosen by you; deletion on request is immediate.
- Throttling: Microsoft Graph rate limits are respected (Retry-After), one request at a time per user.
Report a vulnerability: support@atesensoftware.com, subject "SECURITY".