--- title: "Permissions, Data Storage and Privacy in Questions and Answers" description: "Reference for administrators and security officers on the Vitextra Questions and Answers web part: no API permissions, every call made as the signed-in user, the SharePoint list that holds questions, answers, attachments and comments, which SharePoint permission levels readers, askers and editors need, how to let employees ask without letting them publish, what is not indexed by search, what the web part sends to Vitextra, third-party video embeds, retention and reporting with Excel and Power BI" url: https://vitextra.com/en/support/kb/10384 language: en published: 2026-10-31 modified: 2026-10-31 products: - "Questions & Answers" author: "Lidija Reising" tags: ["Questions and Answers permissions", "FAQ web part security", "SharePoint list permissions FAQ editors", "who can publish questions", "Add Items permission ask a question", "FAQ data storage SharePoint list", "web part privacy GDPR", "NoCrawl list search", "Vitextra Questions and Answers"] --- # Permissions, Data Storage and Privacy in Questions and Answers Reference for administrators and security officers on the Vitextra Questions and Answers web part: no API permissions, every call made as the signed-in user, the SharePoint list that holds questions, answers, attachments and comments, which SharePoint permission levels readers, askers and editors need, how to let employees ask without letting them publish, what is not indexed by search, what the web part sends to Vitextra, third-party video embeds, retention and reporting with Excel and Power BI ## Overview [Questions and Answers](https://vitextra.com/en/products/questions-and-answers) is a SharePoint Framework web part that stores everything in a SharePoint list of your own site and reads and writes it with the rights of the signed-in user. That single fact answers most security questions, but the details matter when you decide who may ask, who may publish and what leaves the tenant. This article is the reference for those decisions. ## Summary for administrators | Question | Answer | |---|---| | Which API permissions does the package request? | None | | Whose identity is used? | The signed-in user, for every read and write | | Where are questions, answers, attachments and comments stored? | In one SharePoint list on the site where the web part runs | | Does the web part store anything elsewhere? | No — not on Vitextra servers and not in the browser | | Who can read the knowledge base? | Everybody with **Read** on the list (and the page) | | Who can ask a question? | Users with the **Add Items** permission on the list | | Who can publish answers? | Users who can **edit** items of the list | | What is sent to Vitextra? | Technical identifiers for the license check and usage telemetry; no content | | Third-party services? | Only YouTube or Vimeo players, when an editor puts such a link into a question | ## Permissions of the solution - The package requests **no API permissions**: nothing appears on the **API access** page of the SharePoint admin center, and the web part never calls Microsoft Graph. - The web part uses the **SharePoint REST API** of the current site to read lists, items, attachments and comments, to create the list and its columns, to add a question and to add a comment. Every call carries the identity of the signed-in user; SharePoint applies its permissions to each one. - The live profile card of the contact person and of mentioned users is the standard SharePoint component, loaded from SharePoint itself. ## The list The web part creates (or connects to) a **custom list** with the columns described in [KB10382. Questions and Answers Web Part Settings Reference](https://vitextra.com/en/support/kb/10382). It is an ordinary list in **Site contents**: - it inherits the **permissions** of the site unless you break the inheritance; - it is covered by the **retention**, **eDiscovery**, **audit** and **backup** of your tenant like any list; - **versioning** can be enabled in the list settings to keep the history of answers; - it is created with **NoCrawl** set, so its items do not appear in SharePoint search results or in Microsoft 365 search — the web part has its own search. If you want the questions to be found by the global search, clear **Allow items from this list to appear in search results** → *Yes* in **List settings → Advanced settings**; - deleting the web part from a page does not delete the list; deleting the list deletes the questions, their attachments and comments (recoverable from the recycle bin for the usual period). The web part's own settings — the connected list, the switches, sort and page size — are stored in the web part properties of the page. ## Who can do what Three roles follow from the SharePoint permission levels on the list: | Role | Needs | Can | |---|---|---| | **Reader** | **Read** on the list (and on the page) | Browse, search, expand answers, open attachments, follow links, copy links to questions, see comments | | **Asker** | **Add Items** on the list — included in **Contribute** and **Edit** | Everything a reader can, plus **Ask a Question** and adding comments | | **Editor** | **Edit Items** on the list — included in **Contribute** and **Edit** | Everything above, plus writing answers, setting categories, attachments, and **Published = Yes** | The **Ask a Question** button is shown only when the web part confirms that the user has **Add Items** on the list; the switch in the property pane enables the feature, the permission decides who sees it. Unpublished questions are never returned to the web part, whatever the user's permissions; an editor sees them only in the list. ### Letting people ask without letting them publish **Contribute** lets a user add items *and* edit any item — including setting **Published = Yes** on somebody else's draft, or changing an answer. To keep publishing in the hands of the editors while everybody may ask: 1. Open the list, **Settings → List settings → Advanced settings**. 2. Under **Item-level Permissions**, set **Create and Edit access** to **Create items and edit items that were created by the user**. 3. Give the broad audience **Contribute** on the list and the editors' group **Edit** (or make them list owners); **Edit** and higher are not restricted by the item-level setting. With this setting an employee can submit a question and later edit *their own* submission, but cannot touch other items. The editors publish. Optionally set **Read access** to **Read all items** (the default) so that the web part can show published questions to everybody. ❗ **Important** **Add Items** on the list implies the ability to add attachments and comments to one's own items through the SharePoint user interface, not only through the web part. Keep the list's advanced settings (attachments, comments) in line with what you want to allow. ### Guests Guest users with access to the site are readers or askers according to their permission level; the live profile cards may show less information for guests. External sharing of the page does not share the list: a person who can open the page but not the list sees an error instead of the questions. ## Attachments and comments Attachments are stored with the list item in the list's own attachment folder; they follow the item's permissions and are deleted with it. Comments are the SharePoint list comments of the item (see [KB10381. Comments, @Mentions and Deep Links in Questions and Answers](https://vitextra.com/en/support/kb/10381)); they can be disabled for the list in **Advanced settings → Comments**. ## What is sent outside the tenant | Purpose | What is sent | Where | |---|---|---| | **License check** | The Tenant ID, the object ID of the user, the site address, the identifier, name and version of the product | `vitextra.com` | | **Usage telemetry** | An event when the web part loads (product and version, site ID and address, the object ID of the user, the interface language, whether the web part runs in Teams) and technical details of errors | Azure Application Insights | | **Product files** | An ordinary request for the scripts and icons of the web part | `static.vitextra.com`, `vitextra-storage.azureedge.net` | | **Video players** | When a question has a YouTube or Vimeo address and **Video** is shown: the browser loads the player from `youtube.com` or `player.vimeo.com`, which see the ordinary request of the user's browser | YouTube, Vimeo | | **File-type icons** | Icons for attachment cards, loaded from Microsoft's CDN | `static2.sharepointonline.com` | No question, answer, attachment or comment is sent to Vitextra or to any third party. The complete picture across Vitextra products is in [KB10363. Where Vitextra Products Store Your Data: Privacy, Data Residency and GDPR](https://vitextra.com/en/support/kb/10363). 📝 **Note** If your organization does not allow content from YouTube or Vimeo on the intranet, keep **Video** on *Hide* or use videos stored in SharePoint — a direct link to an `.mp4` file in a document library plays in the browser's own player without any external request. ## Reporting and export Because the content is a list, the standard tools apply: **Export to Excel** from the list command bar, a **Power BI** report on the list (for example, questions per category, unanswered submissions by age), a **Power Automate** flow that notifies the editors when a question is submitted (trigger *When an item is created* with **Published = No**), and **list alerts** for the same purpose.