IT & Security Centre
Everything your IT team will ask, answered before they ask.
Controller is built for a security review. The package is small, readable, and contains no code, no credentials, and no connection to Supersion.
Data flow — Microsoft 365 edition
The data never crosses to our side.
Your Microsoft 365 tenant
Your finance files
Policies, slides, and Excel files in the one folder you choose.
Your Copilot
Microsoft 365 Copilot reads with the signed-in user's own permissions. The trial package does not pin a folder URL.
Controller
The installed agent applies the review methodology and returns ranked findings.
Supersion
The methodology
Review procedures, evidence rules, and safety limits, delivered as a package your IT team inspects before installing.
What we never receive
Your financial statements, journals, transactions, policies, or conversations. There is no Supersion server in the path.
Disclosure
The eight questions.
| Where does finance data go? | It stays in your Microsoft 365 tenant. Copilot retrieves it through your Microsoft environment; Supersion does not receive the underlying files, and there is no Supersion server in the path. |
| What permissions are required? | The trial package lists no SharePoint URL. Microsoft then allows Copilot to retrieve any file the signed-in user can already open. Controller's instructions limit the review to the one folder of policies, slides, and Excel files that the user names in the conversation. The package requests no Microsoft Graph permissions, no connectors, and no web search. A production package pins one folder URL in declarativeAgent.json. Review the manifest before installing. |
| Does it bypass existing access control? | Microsoft 365 retrieval uses the signed-in user's existing access. The trial package does not narrow that access to one folder; the instructions do. Validate both in your tenant before anyone points Controller at live books. |
| What external APIs are called? | None. The Microsoft 365 edition is declarative only. Any future action or connector will be disclosed separately and will ship with its own security review material. |
| What code executes? | None written by Supersion. The package is two JSON manifests and two icons. The instructions are plain text you can read in declarativeAgent.json. |
| Can we uninstall it? | Yes. Remove the app in Teams, or unpublish it in the Microsoft 365 admin centre. Nothing else is installed, so there is nothing else to revoke. |
| How are updates controlled? | Each release has a version number and a published SHA-256 checksum. Nothing updates itself: your IT team reviews and uploads each new version. |
| Can the model make accounting decisions? | No. Controller produces analytical indicators, evidence requests, and review suggestions for professional judgement. It never writes back to a financial system. |
Package inventory
Four files. Nothing else.
The download is a standard Microsoft 365 app package (.zip). The installation page lists its version and SHA-256 checksum so you can verify the file you review is the file you install.
| File | Contents |
|---|---|
manifest.json | Microsoft 365 app manifest: name, version, developer details, and a pointer to the agent definition |
declarativeAgent.json | The agent: its instructions, whether a SharePoint folder is pinned, and its starter prompts |
color.png | 192 × 192 app icon |
outline.png | 32 × 32 outline icon |
Deployment
Install, roll back, remove.
- Review manifest.json and declarativeAgent.json from the package.
- Verify the SHA-256 checksum against the installation page.
- If custom-app upload is allowed, an authorised user uploads the .zip in Teams. Otherwise publish it through the Teams admin centre.
- Run the validation checklist against synthetic data before production use.
- To roll back, upload the previous version. To remove, delete the app.
Limitation
Decision support, not assurance.
Agent output is decision support. Finance professionals retain review and approval responsibility. The language model is your own Microsoft service, so wording can vary between runs; the methodology fixes the structure and the rules.
Security questions or a vulnerability to report: hello@supersion.com.