This page is for the people who have to review TemplateManager365 before it can be used: IT administrators, security teams and procurement. It is deliberately blunt about what we do and do not have.

The short version

• Your templates never leave your Microsoft 365 tenant. They are stored in your own mailbox or your Microsoft 365 group, and the add-in reads and writes them by calling Microsoft Graph directly from the user’s Outlook session.
• We operate no server that receives your template content, message bodies, subjects, recipients or attachments. There is no endpoint of ours that could.
• The add-in does send a small amount of usage and error information. It is listed in full below.
• We hold no security certifications. See Certifications — we would rather say so than imply otherwise.

Architecture

TemplateManager365 is an Office add-in: a web page that Outlook loads and runs inside the client. It has no backend of its own for template data.

1. Outlook loads the add-in from https://www.templatemanager365.com.
2. The user signs in with their own Microsoft 365 work or school account. The resulting token stays in the Outlook session and is never transmitted to us.
3. The add-in calls Microsoft Graph from the user’s machine to read and write templates.
4. Templates are stored either in a hidden folder in the user’s mailbox, or in the document library of a Microsoft 365 group.

The practical consequence is that template data is governed by your own tenant’s controls. Your retention, backup, eDiscovery and access policies apply to it, because it is ordinary Microsoft 365 data in your own tenant. Nothing needs to be trusted to us for that content to be protected.

Microsoft 365 permissions

Permission	Why it is needed
User.Read	Sign in and identify the account
Mail.ReadWrite	Read and write templates in the hidden folder in the user’s mailbox (Mailbox Store)
Group.Read.All	List the Microsoft 365 groups the user belongs to, so they can pick one (Group Store)
Files.ReadWrite.All	Read and write template files in the group’s document library (Group Store)

Mail.ReadWrite and Files.ReadWrite.All are broader than what the add-in uses. Microsoft does not offer a permission scoped to a single folder, so these are the narrowest available scopes that allow templates to be stored where they are. The add-in only reads and writes its own TemplateManager365 folder.

Only the permissions for the store you choose are requested. A user of the Mailbox Store is never asked for group or file access. There is more detail, per consent-screen wording, in TemplateManager365 Permissions.

Why AppSource warns that data may be sent to a third party

Microsoft applies a standard warning to every add-in that can access mailbox content, because an add-in could transmit what it reads. It describes a capability, not our behaviour. Template content is exchanged only with Microsoft Graph, and you can verify that on your own network — the complete list of addresses the add-in contacts is in the firewall section, and everything other than Microsoft Graph and our web server can be blocked without affecting functionality.

What we do receive

What	When	Contains
Usage statistics	When a template is applied	A one-way hash of the user’s email address, which store is in use, and the number of templates and folders
Product analytics	While the add-in is open	Which screens and actions are used
Error reports	Only on failure	Technical error details and a stack trace

A hashed address is a pseudonym rather than anonymous data: someone who already holds an address can test whether it matches. We treat it as personal data accordingly. None of this includes template content. Our privacy policy covers it in full, and all three endpoints are optional and can be blocked.

Certifications

We would rather answer this plainly than leave you to find out later:

	Status
SOC 2 Type II	No — not held, not in progress
ISO 27001	No — not held, not in progress
HECVAT (Lite or Full)	Not completed
VPAT / WCAG accessibility conformance report	Not completed
HIPAA Business Associate Agreement	Not offered — do not use TemplateManager365 for PHI on the basis that we will sign a BAA

TemplateManager365 is a free add-in from a small company. We have not undertaken these audits, and claiming to be “aligned with” a standard we have not been certified against would be worse than saying no.

What we would ask you to weigh instead is the architecture: there is no service of ours holding your template data, so the assurance you need about that data is assurance about your own Microsoft 365 tenant, which you already have.

If a certification is a hard requirement for your organisation, we would rather you knew that now.

GDPR

Sol Inventum OÜ is an Estonian company, so the GDPR applies to us directly.

• For template content we are not a processor, because we never receive it.
• For the usage, analytics and error data described above we act as a data controller.
• A data processing agreement is available on request — email the address below.

Reporting a security issue

Email [email protected] with the details. If you believe you have found a vulnerability, please tell us before disclosing it publicly, and we will keep you informed of what we do about it.

---

Last reviewed: 20 July 2026.