Your permissions, nothing more
Every read and every action goes through SharePoint in the person's own context. ExpiryPoint can only see and change what that person already can. It has no service account and no extra rights.
Privacy and permissions
It runs in your tenant, as you, and keeps every decision there.
ExpiryPoint has no server, and no admin consent is needed to use it. It works through SharePoint with the signed-in person's own rights; one optional permission switches on email. The only thing it ever sends us is a small licence check-in that a site owner can switch off.
No admin consent needed
No admin consent and no Azure app registration are needed to use ExpiryPoint, and no Microsoft Graph permission is required. Uploading the package to the app catalog is the only admin step. One optional permission (Microsoft Graph, Mail.Send, delegated) switches on email; a SharePoint administrator approves it in the SharePoint admin centre under Advanced, API access.
Reviewing never changes a document
Decisions and review dates are kept in ExpiryPoint's own hidden lists, not on the files, so a file's Modified date and version history stay as they were. ExpiryPoint reads file details such as names, dates, owners, content types and labels, never what is inside your files.
Review data in your own site
Review records, rules, settings and the decision log live in hidden lists on your SharePoint site. Hidden means out of the site navigation; it is not a security boundary, and the lists follow your site's own permissions.
Email from your own mailbox
With Mail.Send approved, reminder and notification emails go through Microsoft Graph from the signed-in person's own mailbox. Without it, people get a pre-filled email to send themselves. Scheduled reminders and Teams messages come from a Power Automate flow you own. None of it goes through Apps 365.
Retirement is a mark first
Mark for retirement changes nothing in the file. Moving, labelling or recycling retired files only happens if a site owner switches it on, and an approver or owner carries it out. Nothing is ever deleted permanently.
Licence keys stay off the page
A site owner or SharePoint administrator enters the key once, under Licence. It is checked on your device and never shown on the page afterwards; Licence shows what it covers and until when.
Nothing loaded from outside
Every script, style and icon ships inside the package. It loads nothing from other websites, which keeps it working under SharePoint's content rules.
The one thing it sends
A small daily licence check-in, which a site owner can switch off.
Licence keys are checked on the device; there is no licence server for the app to call. Separately, once a day, it tells Apps 365 a few facts so we can support your licence.
| Sent | Never sent |
|---|---|
| Microsoft 365 tenant ID | Names or email addresses |
| Site and site collection address | File names, dates or content |
| App version | Review dates or decisions |
| Licence state, plan and key IDs | Licence keys themselves |
A site owner can switch it off under Licence at the top of ExpiryPoint. ExpiryPoint works exactly the same without it. Details in our privacy notice.
Limits
What it does not do.
- It does not make anyone compliant. It helps evidence periodic review, for example the policy reviews ISO 27001 Annex A 5.1 asks for. Whether that meets a control is for you and your auditor.
- It does not know who read a file. SharePoint gives apps no dependable last-opened date; views are shown as recorded by search, which are approximate and can lag.
- It does not judge what is in a document. Whether a file is still right is the reviewer's decision; ExpiryPoint makes sure someone makes it.
- It does not change who can see a file. For that, see ExposurePoint, which shows and fixes who can open a site's content.