Trust and security
Security and Microsoft certification
Understand Microsoft certification, the security requirements applied to Ataytis Vega Studio, and how data, specifications, and templates are handled.
What Microsoft certification means
Ataytis Vega Studio is a Microsoft-certified Power BI visual. Certified visuals are AppSource visuals that meet specified Microsoft Power BI code requirements and testing. Microsoft describes the tests as being designed to check that a visual does not access external services or resources.
Certification adds a dedicated review beyond normal AppSource publication. The submitted package and source are assessed against Microsoft's certification policies before the certification badge is granted.
What the certification review covers
- Code review and static-code analysis against Power BI visual certification requirements.
- Checks for data leakage and attempts to access external services or resources.
- Data fuzzing, penetration testing, cross-site scripting checks, malicious-data-injection checks, and input validation.
- Functional testing and checks for unhandled JavaScript errors across supplied test data.
- Requirements for reviewable open-source dependencies and safe handling of user input or report data in the DOM.
- Restrictions against outbound HTTP/S or WebSocket requests,
fetch,XMLHttpRequest, unsafeinnerHTML, and arbitrary dynamic code patterns prohibited by Microsoft policy.
Why certification matters
| Benefit | Why it matters |
|---|---|
| No external-service access | The certified visual package must not make outbound HTTP/S or WebSocket requests to services outside Power BI. |
| Administrator confidence | Power BI administrators can use the tenant setting that permits certified visuals while blocking non-certified visuals in the Power BI service. |
| Broader Power BI scenarios | Microsoft supports certified visuals in scenarios such as PowerPoint export and images included in report-subscription emails, subject to normal Power BI limitations. |
| Microsoft-defined review criteria | The published package is assessed against Microsoft's documented code, security, and testing requirements. |
| Microsoft Marketplace distribution | Microsoft Marketplace provides a consistent route for discovering and adding the published visual to Power BI. |
How Ataytis Vega Studio handles data
| Information | How it is handled |
|---|---|
| Power BI dataset rows | Power BI supplies the fields assigned to the visual. Vega processing and rendering occur within the Power BI visual host; the certified visual does not send report data to AtaytisTech or another external service. |
| Vega specification and configuration | The applied JSON is persisted as part of the visual's report configuration so the visual can render when the PBIX or published report is reopened. |
| Template export | The Studio records specification, configuration, field metadata, and portable placeholders. It does not package the underlying dataset rows. |
| Optional template preview | A preview is an image of the rendered visual and may visibly contain labels or values. It is included only when the author chooses that option. |
| Downloaded template file | Export is initiated by the report author and uses the visual's declared ExportContent privilege. The resulting file must be governed like any other business document. |
| External URLs in specifications | Certified-visual restrictions prevent outbound web requests, so Studio specifications are self-contained and do not load external data, scripts, fonts, images, or APIs at runtime. |
Security across the Studio workflow
- Microsoft Marketplace and approved organisational visual stores provide the published Ataytis Vega Studio package.
- Power BI controls workspace, report, semantic-model, sharing, export, and tenant permissions around the visual.
- Vega JSON and Studio configuration run without credentials, access tokens, connection strings, or external-service keys.
- Template exports contain specification content, configuration, field metadata, and placeholders rather than Power BI dataset rows.
- Optional template previews are generated only when selected and remain part of the exported template file.
- Imported templates are validated for the Ataytis Vega Studio template structure before field assignment and creation.
Official Microsoft references
Certified Power BI visualsMicrosoft certification requirements, restrictions, capabilities, and certification process.Power BI custom visual security planningMicrosoft guidance for tenant controls, custom visuals, and the certified-visuals-only setting.Sources for Power BI custom visualsMicrosoft guidance on AppSource, organisational visuals, custom files, licensing, and visual trust.