Security

Your data stays in your report

Grafpoint visuals are built for companies that cannot let report data leave their tenant. This page lists what the visuals do and do not do.

What the visuals never do

  • They never send data anywhere. The visuals make no network requests of any kind: no calls to our servers, no analytics, no telemetry, no fonts or scripts loaded from the internet. They do not ask Power BI for web access, so Power BI would block such a request even if one were attempted.
  • They never store your data. Data exists only in memory while the visual draws it. The visuals do not use browser storage or write files, and they keep nothing between sessions.
  • They never read anything outside what you give them. A visual only sees the fields you drag into it, as Power BI passes them. It cannot see other visuals, other pages, the data model or who is viewing the report.
  • We never see your data. Because nothing leaves the visual, we have no access to your reports, your data or your users. We cannot see where or how often a visual is used.

How the licence key works

  • Your licence key is checked inside the visual, offline, using a digital signature (Ed25519). The visual carries only our public key; there is no “phone home”.
  • The key contains what you bought, the licence type, seats, the expiry date, an order reference and your company name. It contains no report data and no information about your users.
  • The key is saved in the report like any other format setting, so anyone who can open the report can see it. Treat it like a product key, not a password.
  • A visual works the same with no internet connection, in Power BI Report Server, in embedded reports and in air-gapped environments.

How Power BI protects you as well

  • Power BI runs every custom visual in a sandboxed iframe, isolated from the report, the rest of the page and your data model.
  • Network access, local storage and file export are privileges a visual must declare in its manifest (capabilities.json) before Power BI allows them. Grafpoint visuals declare none of them.
  • Every Grafpoint visual is written to Microsoft’s rules for certified visuals, and we are submitting each one for certification. This page will say when a visual is certified.

Check it yourself

  • Network: open the report in a browser with the developer tools open on the Network tab. Grafpoint visuals produce no requests.
  • Manifest: a .pbiviz file is a zip archive. Open it and read capabilities.json; the privileges list is empty.
  • Admin controls: Power BI admins can allow only certified visuals, or add Grafpoint visuals to the organisation’s own visuals, in the Power BI admin portal.

How we build them

Every release is checked against the same rules: no privileges in the manifest; no fetch, XMLHttpRequest, WebSockets or external URLs; no eval or HTML string injection; no browser storage or cookies; no analytics or telemetry libraries; Microsoft’s Power BI lint rules and npm audit clean; and a load test in Power BI Desktop and the service with the Network tab open. Each visual has its own source repository, so Microsoft can review it for certification.

Our website and store

Buying a licence involves a small amount of personal data (name, email, company), handled as described in our privacy policy. Payments are processed by Paddle; we never see card details. None of this is connected to the visuals. The website sets no cookies of its own and counts visits with Cloudflare Web Analytics, which is cookieless.

Our signing key is kept as an encrypted secret in our licence service, with one offline backup. Every account we use to run Grafpoint has two-factor authentication. If the signing key were ever exposed, we would ship visuals with a new key, reissue keys to every active customer, and say so on this page.

Report a security issue

Email security@getgrafpoint.com. We answer within two working days and tell you when the issue is fixed. Our security.txt has the same details.