In this article, you will find an overview of key measures and procedures in place to minimize and protect user data at Power-user.

Security at a glance

• Power-user is installed and runs locally on the user's computer. Your documents never leave your environment and are never accessible to Power-user.
• Only minimal data is collected, for license management, support and billing. No sensitive data, no passwords, no document content.
• Client data is hosted by OVHcloud in France, and personal data is processed under a GDPR Data Processing Agreement.
• All third-party services, including AI features, are optional and can be disabled centrally by your administrators.
• Power-user is currently working towards ISO/IEC 27001 certification.

TABLE OF CONTENTS

• How Power-user runs in your environment
• Data collection
  • Power-user does not collect sensitive data
  • Power-user does not have access to documents you add to your Library
  • Data collected by Power-user
  • Why we still need some data, and how we use it
  • Data exchanges with integrated partner services (optional features)
  • Data usage for AI features (optional features)
  • Data is protected both contractually and technically 
  • Other assurances on user data
• Data protection measures and procedures
  • Risk assessments
  • Data Encryption
  • Backup
  • Access control
  • Incident reponse
  • Security Awareness Training
  • Network security
  • Application security and vulnerability management
  • Continuous improvement

How Power-user runs in your environment

Power-user is a Microsoft Office add-in installed on each user's Windows computer. It runs locally, inside PowerPoint, Excel and Word, and does not require users to sign in once the license is activated.

Once activated, Power-user keeps working offline. Without a connection, users do not receive software updates, their license status is not reported to your license administrators, and shared libraries configured by administrators are not refreshed. Existing users can keep working even if the Power-user licensing service is temporarily unavailable.

The Power-user installer and add-in are digitally signed by Power-user SAS. IT teams can deploy Power-user by script or through Microsoft Intune or a custom script.

Data collection

Below is a diagram view of data exchanges between the users devices, the Power-user service, the Admin portal and third-party services. 

Power-user does not collect sensitive data

We strongly believe that the best way to protect data is to avoid sharing any data that is not essential. For this reason, Power-user was designed to collect only minimal data:

• Power-user does NOT collect user passwords.
• Power-user does NOT collect any documents or content users are working on.
• Power-user does NOT collect sensitive data such as racial or ethnic origin, sexual orientation, health, political opinions, religious or philosophical beliefs.

Power-user does not have access to documents you add to your Library

Admins of Power-user licenses can integrate corporate resources in the Library (in particular PowerPoint presentations or Excel spreadsheets). 

By default, Power-user does NOT need access to such files in order to integrate them, and Power-user will only know the link and name of the files. The files will be pulled locally from the given link on your system where they are stored, as illustrated below:

Data collected by Power-user

Of course, we still need some data to make our application work, manage licenses and provide the appropriate level of support. We do collect:

• Data about the user: the Windows user name, email address, organization name and domain and job title, as well as user settings.
• Technical data: license key; software version and license type for Power-user and the Microsoft 365, dates of installation/validity, logs.
• Usage data to understand how the application is used.

Why we still need some data, and how we use it

The data Power-user collects is needed for the following purposes: 

• License management: managing the validity of licenses, allowing, controlling and revoking access, transferring licenses to new devices, and allowing admins to do the same from their administration portal.
• Support: providing relevant support to user emails and tickets, informing users about key events related to their license, and providing them with appropriate documentation 
• Billing: quantifying licenses consumption and validity, and answering regulatory obligations 

Data exchanges with integrated partner services (optional features)

With the exception of the services described below, Power-user does not send any user data to third-parties. 

Power-user integrates optional services from several partners to enable specific functionalities directly from the application. Our current partners are:

• Pexels
• Unsplash
• Logo.dev
• Magnific
• OpenAI

The data exchanges with these partners is done via the following process:

• The user writes keywords or an image prompt and parameters from the Power-user Library
• A Power-user url is called, which then calls the partner's API to create the request
• The partner sends back one or several image files that will be downloaded on the user machine and displayed in the Library.

Requests to partner services are routed through Power-user's servers. Partners therefore receive the keywords or prompt entered by the user, but not the user's identity, organization or document. Power-user does not store or retain the prompts, text or content submitted to these services.

Organizations can also deactivate specific features for their users, or deactivate all API calls to third-party services. See more here.

Data usage for AI features (optional features)

Power-user integrates AI services from 2 partners:

• The OpenAI API (GPT-4.1-mini) is used for processing text for the AI Assistant functionality. 
• The Magnific API is used for creating images via an AI prompt.

Below is a summary of how data is handled and protected by OpenAI:

• No training on your data via the API. Data sent to OpenAI via the API is not used to train OpenAI’s models. This differs from usage on chat.openai.com.
• Temporary retention for abuse monitoring only. OpenAI may store API data for up to 30 days to monitor for abuse and ensure system integrity. After that, data is automatically deleted, unless legally required.
• Secure data handling: All data is encrypted in transit (TLS) and at rest. Access is strictly limited and controlled within OpenAI’s secure infrastructure.
• No resale or commercial reuse of your data: OpenAI does not sell or reuse your data. It is processed solely to provide the API-based service.
• GDPR compliance: OpenAI complies with the General Data Protection Regulation (GDPR). Power-user complements this with its own data protection practices and contracts (e.g., DPA, transparency on data flows).
• It is the user's responsibility to respect OpenAI's terms of use.

The official reference guide from OpenAI can be found via this link. As a reference, the integration with Power-user is based on the /v1/responses endpoint. 

Below is a summary of how data is handled and protected by Magnific:

• The user is the sole and exclusive owner of all rights for all inputs, as well as outputs as long as they comply with Magnific's terms of use.
• Magnific will not use Inputs or Outputs to train its own AI models.
• Inputs and Outputs used or generated through the AI Products will be treated as confidential.
• Magnific is RGPD compliant, ISO/IEC 27001 and SOC 2 Type 1 certified.

The official Privacy Policy from Magnific can be found via this link.

Note that for both these services, the user doesn't need to have their own account. The AI provider doesn't know who is sending a specific input, it doesn't have access to the history of the user, of the organization or of the document, but only really to the direct input.

Organizations can deactivate AI features, preventing their users from triggering calls to OpenAI's APIs. See more here.

Data is protected both contractually and technically 

Any data we collect and use is contractually protected by our Data Privacy Policy and License agreement.

We also have technical measures and procedures in place to protect data from threats, as described below.

Other assurances on user data

Power-user is listed on the Microsoft Appsource and Microsoft Azure Marketplace, after undergoing a Microsoft process including different reviews, scans and tests from the Microsoft teams

We can also share multiple references from clients in industries with very-high security standards, like defense or payments/banking.

Finally, we can give IT teams access to a test version of Power-user to be tested and analyzed before deployment.

Data protection measures and procedures

The goal of our Information Security Program is to ensure the protection of all information, including client data, intellectual property, and internal systems. This program is designed to meet industry best practices, comply with relevant laws, and instill confidence in clients regarding the security of our software development processes. 

Risk assessments

• A risk assessment is performed at least annually, to identify potential threats, vulnerabilities, and areas of improvement.
• All assets, tools and applications used at Power-user are mapped and classified based on purpose, sensitivity and risk.

Data Encryption

Our client data is hosted at OVH in France, and fully encrypted:

• Data in transit is encrypted with TLS (Transport Layer Security) 1.3 or 1.2. 

• Data at rest at OVHCloud is also encrypted. OVHCloud is certified ISO/IEC 27001, HDS and SO2, among others. More information can be found on the OVHCloud website.   
  

Emails and tickets are also encrypted with AES 256-bit encryption when data is encrypted at rest and HTTPS with TLS 1.2 encryption for data in transit.

All company laptops are encrypted with Bitlocker.

Backup

Client data is backed up by OVHcloud on separate servers and encrypted. Internal documents and emails are backed up through Microsoft 365, and source code is hosted and backed up on GitHub. Internal documents are also copied annually to a secure offline drive.

Power-user maintains a Business Continuity Plan, reviewed at least annually. It sets a recovery objective of 24 hours for client data and requires at least one backup restoration test per year. Because Power-user runs locally, existing users can continue working during an outage of our backend services.

Access control

• Access to our offices is physically restricted to authorized personnel only, monitored and logged with 24/7 videosurveillance.
• Role-based access control (RBAC) ensures employees only have access to systems necessary for their roles.
• All devices are password-protected.
• Multi-Factor Authentication is in place and mandatory.

Incident reponse

Power-user has not faced any major incident in the past 10 years.

Power-user maintains an Incident Response Plan covering detection, containment, recovery, communication and post-incident review.

The plan is reviewed annually and after any major incident. In the event of a personal data breach affecting client data, Power-user notifies the client without undue delay, with the information needed to meet their own regulatory obligations.

Where required, Power-user also notifies the French supervisory authority (CNIL) within 72 hours.

Security Awareness Training

• All new hires undergo security orientation as part of their onboarding.
• Regular security awareness trainings or communications are conducted to identify potential threats, vulnerabilities and areas of improvement.

Network security

• Power-user operates a cloud-first model with no on-premise corporate network or file server, which limits lateral propagation risk.
• Updates and patches are regularly installed on software and hardware to protect against known vulnerabilities.
• Power-user's internal devices are managed with Microsoft Intune and protected by Microsoft Defender for Endpoint. This provides built-in next-generation antivirus and advanced EDR/XDR capabilities, ensuring continuous protection and monitoring of user devices without requiring third-party security software.

Application security and vulnerability management

Security is integrated into our development lifecycle: secure coding practices, systematic code reviews, automated static code analysis (SAST) with Sonar, dependency management and protection of source code repositories with access controls and multi-factor authentication.

Credentials are never stored in source code repositories.

We track security advisories and CVEs affecting our components, update third-party libraries and apply security patches promptly.

External vulnerability scans of our public services are performed periodically by a third-party security specialist, and internal devices are continuously monitored with Microsoft Defender.

Power-user has been assessed through penetration tests commissioned by enterprise clients as part of their vendor assessments. 

Independent penetration testing is to be set up as part of our ISO 27001 program.. 

Continuous improvement

Power-user is currently working towards ISO/IEC 27001 certification. Our information security management system already includes an Information Security Policy, an annual risk assessment and risk register, a Data Classification Policy, an Incident Response Plan, a Business Continuity Plan and an IT acceptable use charter for all staff.

We foster a culture of continuous improvement by incorporating feedback from audits, employee input, and evolving security practices.

We stay informed of emerging threats and security technologies to ensure the program remains effective and relevant.