When an enterprise team evaluates a new Azure DevOps extension, the security and procurement review often requires a detailed explanation of what data the extension accesses, where it is stored, and whether anything leaves the tenant. The new Data & Privacy view in Agile Analytics provides that information inside the product itself — no separate document required.
What is sent, and what never leaves
The view is explicit in both directions, because a trust page that only lists reassurances is not a trust page. What is sent to Baytek:
- Your Azure DevOps organisation ID — so we can confirm your subscription or trial is active
- Usage and error telemetry — which views are opened and what failed, so we find breakage before you report it. This can be switched off under Configuration → Privacy
What never leaves your tenant
Everything that would actually be sensitive stays inside Azure DevOps:
- Work item content — titles, descriptions, comments and field values
- Project and team names
- User names and email addresses
- Read-only ADO access — the extension never writes to your work items or project data
- Settings stored in ADO only — extension configuration lives in your ADO organisation's extension data storage
- No third-party analytics SDKs are embedded in the extension
ADO Permissions
The extension requests three OAuth scopes, all read-only:
- vso.work — read work items, queries, boards, and iteration paths
- vso.project — read project and team metadata
- vso.graph — read user and group membership for Access Control
Data Inventory
The Data & Privacy view lists every category of data the extension reads:
- Work items: title, type, state, area path, iteration path, story points, created and resolved dates
- State history: every state transition event for each work item
- Sprints and iterations: dates, names, and team assignments
- Teams and projects: names, member lists (for Access Control)
How to Use This in a Procurement Review
Instead of preparing a separate trust document or data processing agreement summary, point procurement reviewers directly to the Data & Privacy tab in the extension. The view is accessible to all users without Admin access. For organisations with formal DPA requirements, combine this tab with the security page on this website for a complete evaluation package.