Trust and security
Security and Microsoft certification
Understand Microsoft certification, the security requirements applied to Ataytis Vega Studio, and how data and specifications are handled.
What Microsoft certification means
Ataytis Vega Studio is a Microsoft-certified Power BI visual. Certified visuals are AppSource visuals that meet specified Microsoft Power BI code requirements and testing. Microsoft describes the tests as being designed to check that a visual does not access external services or resources.
Certification adds a dedicated review beyond normal AppSource publication. The submitted package and source are assessed against Microsoft's certification policies before the certification badge is granted.
What the certification review covers
- Code review and static-code analysis against Power BI visual certification requirements.
- Checks for data leakage and attempts to access external services or resources.
- Data fuzzing, penetration testing, cross-site scripting checks, malicious-data-injection checks, and input validation.
- Functional testing and checks for unhandled JavaScript errors across supplied test data.
- Requirements for reviewable open-source dependencies and safe handling of user input or report data in the DOM.
- Restrictions against outbound HTTP/S or WebSocket requests,
fetch,XMLHttpRequest, unsafeinnerHTML, and arbitrary dynamic code patterns prohibited by Microsoft policy.
Why certification matters
| Benefit | Why it matters |
|---|---|
| No external-service access | The certified visual package must not make outbound HTTP/S or WebSocket requests to services outside Power BI. |
| Administrator confidence | Power BI administrators can use the tenant setting that permits certified visuals while blocking non-certified visuals in the Power BI service. |
| Broader Power BI scenarios | Microsoft supports certified visuals in scenarios such as PowerPoint export and images included in report-subscription emails, subject to normal Power BI limitations. |
| Microsoft-defined review criteria | The published package is assessed against Microsoft's documented code, security, and testing requirements. |
| Microsoft Marketplace distribution | Microsoft Marketplace provides a consistent route for discovering and adding the published visual to Power BI. |
How Ataytis Vega Studio handles data
| Information | How it is handled |
|---|---|
| Power BI dataset rows | Power BI supplies the fields assigned to the visual. Vega processing and rendering occur within the Power BI visual host; the certified visual does not send report data to AtaytisTech or another external service. |
| Vega specification and configuration | The applied JSON is persisted as part of the visual's report configuration so the visual can render when the PBIX or published report is reopened. |
| Specification copied out of the editor | The JSON you copy from the Spec editor contains the specification and its configuration only. It does not package the underlying dataset rows, and any copy you keep must be governed like any other business document. |
| External URLs in specifications | Certified-visual restrictions prevent outbound web requests, so Studio specifications are self-contained and do not load external data, scripts, fonts, images, or APIs at runtime. |
Security across the Studio workflow
- Microsoft Marketplace and approved organisational visual stores provide the published Ataytis Vega Studio package.
- Power BI controls workspace, report, semantic-model, sharing, export, and tenant permissions around the visual.
- Vega JSON and Studio configuration run without credentials, access tokens, connection strings, or external-service keys.
- A specification copied out of the editor contains specification and configuration content rather than Power BI dataset rows.
- A pasted specification runs entirely inside the visual host and cannot reach an external service to fetch data or code.
Official Microsoft references
Certified Power BI visualsMicrosoft certification requirements, restrictions, capabilities, and certification process.Power BI custom visual security planningMicrosoft guidance for tenant controls, custom visuals, and the certified-visuals-only setting.Sources for Power BI custom visualsMicrosoft guidance on AppSource, organisational visuals, custom files, licensing, and visual trust.