How Altivane Handles Access and Data

It runs on your computer

Altivane is a Windows desktop application. It reads and changes your clients' tenants from your computer, and keeps what it reads and writes there. There is no Altivane cloud service holding your clients' data. The only services it contacts of its own are the licensing service, to activate and renew the licence, the update service, only when you select Help > Check for updates, and an AI service, only if you turn summaries on and give it a provider of your own.

Signing in to a tenant

Each tenant has its own sign-in method, chosen when you add it.

• Certificate. Altivane registers itself in the tenant as an app registration and signs in with a certificate from your personal certificate store. The certificate Altivane creates is valid for 2 years and its private key cannot be exported. Nobody signs in each time, so this is the method for scheduled runs, and the one that supports every feature.
• Interactive. An administrator signs in through the browser with their own account. Nothing is registered in the tenant, and fewer features are available: anything the administrator's own permissions do not cover shows as unavailable.

Altivane never holds a tenant password. The sign-in cache stays on your computer, under your Windows profile.

What access it asks for

When you add a tenant, you choose the access Altivane gets there, and you see the exact permissions and directory roles before anything is granted. An administrator of the tenant signs in and grants the consent. The choices are:

• Reports. Read only. Nothing can be changed.
• Helpdesk. Read, plus the changes made on the Users page: sign-in, sessions, licences, groups, manager, new users, passwords and MFA methods.
• Manage. Read and make changes, except SharePoint site changes.
• Everything, or Custom. Every permission and role, or exactly the ones you select. Everything adds SharePoint full control, which some SharePoint reports use, and access to mail, files and chats, which no feature uses.

Access is only ever added by Altivane. To take some away, use the Entra admin centre. In Azure, Altivane gets the Reader role only on the subscriptions you select, and only when you choose to give it. A change in Azure needs a role that an administrator assigns there; with Reader alone, Azure refuses it.

Where your clients' data stays

What Altivane reads and writes stays on the computer where it runs, except for summary figures sent to your AI provider when you turn on AI summaries.

• Reports, documents, workflow files and change logs go to an output folder, with a folder for each tenant, so you decide where they live and who can read them.
• Settings are a .json file. AI keys, the sign-in cache and the licence are kept outside it, encrypted for your Windows account, so exporting settings to another computer never moves them.
• What pages read can be kept between sessions, encrypted for your Windows account, for 7 days by default. You can turn this off or clear it at any time.

Making and recording changes

A change runs from a window that shows the change, what it applies to and the tenant, and nothing is sent until you run it. For a change that can't be undone, such as Wipe, Enter doesn't run it. Run from the window, a workflow step that removes something always asks.

Unless you turn the change log off in Settings, every change that is sent is recorded in the tenant's change log, on your computer: the change, its target, the values before and after where they can be read, the command sent, who was signed in, and which Windows account and computer made it. When Altivane cannot tell whether a change went through, it never sends it again; the change shows as failed and the record stands.

AI summaries, only if you turn them on

AI summaries in client documents are off until you add a provider of your own (Anthropic, or any service that uses the OpenAI API, including Azure OpenAI or a model on your own computer) and switch them on, for the tenants you choose.

• What is sent is the headings of the scorecard reports, status counts and summary figures. Names and detail tables are never sent, and names, addresses and IDs in the figures are replaced first.
• Your API key is encrypted for your Windows account and is not written to the settings file.
• A record of exactly what was sent and what came back is saved beside each document, and you can see what a summary would send before you turn it on.

Diagnostics stay with you

Altivane keeps a diagnostic log on your computer for 14 days and never sends it anywhere. A support bundle, for your supplier, is a .zip file Altivane saves where you choose and sends nowhere; you decide whether to share it. It leaves out the settings file, the licence key, the sign-in cache, kept data, AI keys, change logs and documents.

Licensing and scheduled runs

A licence key activates Altivane for a Windows account on a computer, through the licensing service, and renews in the background while the computer is online. The key is never accepted on the command line, where other programs could see it. Deactivating a computer frees its seat for another.

Scheduled runs use Windows Task Scheduler and need certificate sign-in; a run without a window refuses a tenant that signs in interactively.

Updates, only when you ask

Altivane checks for a newer version only when you select Help > Check for updates. It asks the update service, sending the product, channel, processor type, version and build. Like any internet request, the check carries your IP address, which the update service keeps in its logs for 30 days.

Questions

The data processing and security statement sets out what we hold, where and for how long, and how we protect it. Its last section answers the questions a security questionnaire usually asks.

If your client's security questionnaire asks something neither answers, contact us.