Sintel Apps and the security of your data

When customers install our Sintel Apps platform from AppSource we are often asked what data Sintel has access to and how secure your tenant and the data within it is.

The first thing to highlight is that both of our apps are rigorously tested and verified by Microsoft and only when each update has been approved do Microsoft make it available for customers to download from AppSource.

____________________________________________________________

Sintel Forms

____________________________________________________________

Key Information

• Our Sintel Forms service has read access to your data as it passes through our service, this is required to display your data on the forms you have designed using our service.
• Additionally, to speed up form performance we may cache the layouts you configure on forms. This includes the fields and their location on the forms but not the data within those fields.
• For licensing purposes, we also track the number of forms that are configured within your SharePoint tenant and this information is required to enable us to manage your license.

With regard to external users (those who may submit forms from outside of your tenant)

• At no point can an external user directly access your tenant, they are not granted access to your tenant or any site within it.
• External users who submit data via anonymous forms do so without requiring or receiving any access to your SharePoint tenant.
• All forms that are submitted by external users can be protected with a captcha to protect your environment from spamming by bots.
• The data submitted by these users is sent via our Sintel Forms service directly into the relevant list you have configured within your tenant.
• Data that is saved into the relevant lists will be created by our service and the “Created By” field will display SharePoint App.
• The email address of the user who submitted the form will be captured in a field in the list titled “SintelFormsExternalData”.
• If you enable external collaboration then external users who submit forms can subsequently edit them by requesting a secure PIN to access their original form. These users do not get access to your tenant and can only interact with their form via our Sintel Forms service.

App Permissions

• By adding our Sintel Forms app into your SharePoint online environment you must grant it the access it needs to enable admins to design form templates and to enable users to fill in those form templates.
• When you add Sintel Forms and authorise it, the process grants it access to read and write access to SharePoint lists and libraries and to read user profile data. All of these permissions are required for the application to work correctly.
• More info can be found in the following Microsoft article Add an app to a site.
• Sintel Forms uses delegated permissions to enable users to create forms and edit them. Additionally, if you enable the External Submissions feature then application permissions are also used as this is required to enable external users (those with no access to your tenant) to submit forms.

Designing Forms

• To use the Sintel Forms Designer a user must have the “Manage Lists” permission within the site they are trying to use the Sintel Forms Designer in.
• This permission is available with the Edit, Design and Full Control permission levels and we recommend that you grant users this access by placing them into a SharePoint group that has that permission level applied to it.
• Some of our customers create a specific SharePoint group for this purpose calling it Sintel Forms Designers and apply the Edit permission level to it. This restricts the use of the Sintel Forms Designer to a limited number of users so that only a select few can design forms which helps ensure consistency of form design across an organisation. Also as you may be aware, when a SharePoint site is created the out-of-the-box “Members” group is granted Edit access and we recommend changing this to Contribute as it is generally sufficient for them.
• Regardless of what permission a user has on a specific list if they do not have the “Manage Lists” permission on the specific site they will be unable to use the Sintel Forms Designer.

Filling in Forms

• Any user that is granted contribute access to a list on which Sintel Forms has been configured will be able to fill in the form template that is configured. This is identical to how standard SharePoint works i.e. users can create content in any list or upload files into any library to which they have contribute access.
• If your form uses linked lists or linked libraries users will need contribute access to those lists also in order to fill in those forms.

Sintel Forms Azure Architecture

Sintel Forms Azure Architecture

Penetrating Testing

Sintel Forms has been rigorously tested by Ward Solutions an independent Irish consultancy company specialising in information security. Their extensive penetration testing helped verify the security of data captured by our product. As a result of their input, additional features were added to our product including attachment whitelisting and field input validation. Additionally, for forms that are used to capture data from external/anonymous users, our links do not contain any reference to the underlying tenant id, and all URLs are anonymized.

US Government Department usage

Most departments of the US government that use our Sintel Forms product are using it on an isolated environment. Anyone whose tenant address looks like *.sharepoint.us are using a dedicated instance of our Sintel Forms product that’s specifically designed for government departments. This dedicated instance receives updates a number of months after they have been applied to our main Microsoft 365 instance. This ensures all updates are not only fully tested by Sintel but in addition, they have been in use by our customers for a number of months before being deployed to the version used by government departments.

____________________________________________________________

Sintel BI

____________________________________________________________

Key Information

• Sintel BI displays dashboards and reports containing data to internal users (users within your tenant).
• Users can only see dashboards that have been shared with them.
• If a user doesn’t have access to a dashboard they will be unable to see or open it.
• If a user is granted access to a dashboard but doesn’t have access to the underlying data then they can open the dashboard but will see no data.
• Visualizations for charts are generated within the user’s browser using their permissions so no data leaves the tenant.
• When using the SQL Connector (retrieving data from a SQL data source rather than from SharePoint), the data is processed by our Sintel servers in order to generate the visualizations on the dashboard. This only occurs with SQl data sources.

While Sintel BI is typically used by internal users it can also be used by External users. To permit external users to use Sintel BI they must be explicitly granted access to a specific site. In this scenario, they have to authenticate using a Microsoft 365 account and will only have access to the specific site and specific dashboard that has been shared with them.

Sintel BI Azure Architecture

Sintel BI Azure Architecture