Add-in: Roster Auditor · Last updated: July 2026
Summary: this add-in does not collect, store, transmit, sell, or share any personal data. It has no servers, no accounts, no analytics, and no third-party trackers. Your data never leaves the Microsoft 365 boundary.
Roster Auditor cross-references the membership roster of a Microsoft 365 group or distribution list you belong to against participation signals you already possess: bounce messages (NDRs) in your own mailbox, in-person attendance you record yourself, attendance reports of Teams meetings you organized, and replies to emails you yourself sent to the group. It shows each member's most recent participation with the evidence behind it. Every follow-up action — a re-engagement draft, a membership removal, a CSV export — is initiated and confirmed by you. No artificial intelligence or external service is involved.
None. The add-in does not collect, log, or retain any information about you, your email, your groups, or your usage. The analysis happens in your own Outlook session and its results are shown only to you.
When you audit a roster, the add-in signs you in (Microsoft nested app authentication) and uses Microsoft Graph — Microsoft's own Microsoft 365 service — to read your own mail, your own calendar, attendance reports for meetings you organized, and the rosters of groups you belong to. If you remove a member, that change is made directly in your organization's Microsoft 365 directory by you, under your own permissions. The data travels only between your Microsoft 365 account and Microsoft Graph. It stays entirely within the Microsoft 365 boundary.
There is no PurposeBuilt Systems server in this process, and no third party receives your data. All permissions are delegated — the add-in can never see more than the signed-in user can already see. Notably, Teams attendance is limited by Microsoft to meetings the signed-in user organized: the add-in cannot observe anyone else's meetings.
Two small things, both inside your own mailbox (Outlook roaming settings), never transmitted to us: in-person attendance dates you record, and a short log of the actions you have taken (for your own reference). Exported CSV files are saved wherever you choose and are yours.
The add-in's static program files (HTML, JavaScript, icons) are served from GitHub Pages. Serving these files involves no customer data.
If this policy ever changes, the updated version will be posted at this URL with a new "Last updated" date.
Questions: Matthew@purposebuilt.systems