Security, privacy and evidence
It runs in your tenant, as the person using it.
Handover Pro has no server of its own. It runs in the browser with each person's own SharePoint permissions, keeps every record in your SharePoint site and sends no handover data to anyone.
No servers, no data leaving
Your records stay in your own SharePoint site. Apps 365 has no access to your tenant or to anything Handover Pro handles.
No extra permissions
No admin consent, no Azure app registration and no Microsoft Graph permissions. It can only do what the signed-in person could do in SharePoint anyway.
Metadata, not contents
Mapping reads names, owners, dates and permissions. File contents are copied only at sealing, as evidence, and only for files nobody else knew about.
Tamper-evident records
Every audit entry carries a fingerprint of the one before it, so a changed, removed or misplaced entry is found and listed.
Its own permissions per handover
Only the people taking part and the site's owners can open a handover. After sealing, reviewers you name can open its package.
Fair to the person handing over
They see your privacy notice before they answer, their answers are their own words, and nothing scores or rates them.
Data it handles
| Data | Where it comes from | Where it is kept |
|---|---|---|
| Names, sign-in names and email addresses of the people taking part | Chosen from your directory by the coordinator or a site owner | The handover's lists and its package |
| File and list metadata: names, addresses, who created and changed items, dates, permissions, sharing links, check-outs | Read from the sites in scope | The handover's register, summarised in the package |
| Interview answers and comments | Typed by the people taking part | The audit trail and the package |
| Approvals, sign-offs and gap decisions, with their reasons | Recorded when people act | The audit trail, the package and the certificate |
| Evidence copies of files only the person handing over edited or could open | Copied at sealing, within limits you set | The package, in a folder only the person taking each one over and the coordinator can open |
Who can see what
- Each handover has its own permissions: only the people taking part and the site's owners can open it.
- Everyone taking part can read the handover's audit trail: answers, comments, approvals and sign-offs.
- The coordinator's right to change the records comes from being a site owner, so it ends if they stop being one.
- The person handing over and the people taking over see only their parts: Interview, Document, Sign-off, Acceptance and Seal.
- When the handover of someone leaving is sealed, their access to its records ends, and Handover Pro checks with SharePoint that it really has.
- In the sealed package, the full records are limited to the coordinator, the approver and reviewers a site owner names, for example HR or compliance.
Site owners have full control of their site in SharePoint. Handover Pro detects changes to its records but cannot stop a site owner from making them.
Protection from tampering
- Every audit entry carries a SHA-256 fingerprint of the one before it, so a changed, removed or misplaced entry is found and listed. Entries with problems are never counted.
- Approvals and sign-offs name a fingerprint of the exact version of the access plan or document they approve. If the version changes, the approval no longer applies.
- The document sent for approval is frozen as a copy whose fingerprint is recorded before anyone approves it.
- The sealed package lists every file with its fingerprint in a manifest, records the manifest's fingerprint on the PDF certificate, and Check package compares every file at any time. README and SHA256SUMS files let anyone check it with standard tools.
The person handing over
- Before starting, the coordinator confirms they have told the person the handover is starting and how their information will be used.
- They see the site's privacy notice before they answer, and their acknowledgement is recorded.
- Answers are their own words. They can say "I don't know" or "not relevant to me", and can comment on the document instead of signing.
- The coverage score measures how complete the handover record is. It never rates the person.
- Text that looks like a password, key or token is flagged as it is typed and saved only if they confirm it.
Network and software
- The app talks only to your SharePoint Online sites, using the signed-in person's session. Its code is served from your app catalog, and it loads no scripts, fonts or images from anyone else.
- Reminders open Microsoft Teams or the person's calendar with a prepared message. Nothing is sent until the person sends it.
- Licence keys are checked in the browser against a public key built into the app. Checking a licence never calls home.
- Once a day per site, Handover Pro sends Apps 365 a small check-in about the installation: tenant ID, site and site collection addresses, app version, licence state and plan, and the licence IDs in use. No names, email addresses or handover content, and no IP addresses are kept. A site admin can switch it off in the web part settings.
Retention and deletion
- Working data (the register, gaps, plan and drafts) is kept until the coordinator or a site owner deletes it after sealing. Site owners are reminded once it is older than the retention period you set (365 days by default).
- The sealed package and the audit trail are kept as the record. Apply your own retention labels or policies if you need them removed after a set time.
Subject access and exports
- On a handover's Audit tab, the coordinator or a site owner can download everything that handover holds about one person. The export is recorded in the audit trail.
- Registers, gaps, access changes and the audit log can be exported as CSV or JSON. Text that starts like a spreadsheet formula is made plain text, so a spreadsheet never runs anything in it.
- Everyone taking part can download the document and their own audit entries.
Evidence for audits
Each handover records who had which access, what was decided for each item and by whom, and when the changes were made and checked. For people changing role or leaving, this helps evidence the access reviews that standards ask for, such as ISO/IEC 27001:2022 control 5.18 (access rights) and NIST SP 800-53 PS-5 (personnel transfer) and AC-2 (account management).
Handover Pro covers SharePoint permissions. Access in other systems, and things it cannot see such as Power Automate flows or meetings, are recorded through the interview answers.
Controller and processor
Your organisation decides which handovers to run and holds all the data, so it is the controller. Apps 365 has no access to your tenant or to the data Handover Pro handles. We provide a privacy and security summary and an administrator guide to help with your data protection impact assessment (DPIA). Ask us for a copy.