1. Overview

TSS Maps for Power BI (“the Visual”) is a map visualization component for Microsoft Power BI, published by The Solution Stack Inc. (“TSS”, “we”). The Visual displays your organization’s data on maps served by ArcGIS (ArcGIS Online or ArcGIS Enterprise). Where a report uses secured ArcGIS content, the Visual can sign the report viewer in using their existing Microsoft work identity through the TSS Token Broker (“the Broker”), a small credential-exchange service. The Broker is optional; it’s needed only for single sign-on to ArcGIS services. If your organization doesn’t use it, no sign-in records are stored for your users. This policy describes what information the Visual and the Broker handle, what is stored, where, for how long, and how it can be deleted.

2. Our role, and your organization’s role

The Visual and the Broker are provided to organizations, not to individuals. If you use the Visual, it is because your organization deployed it.

Customer-hosted deployments. Where your organization runs the Broker on its own infrastructure, your organization controls all stored records, and TSS has no access to them.
TSS-hosted deployments. Where your organization uses the TSS-hosted Broker, your organization determines the purposes of processing and remains the controller of its users’ information; TSS processes the records described in Section 4 on your organization’s behalf and on its instructions, as a service provider (processor). Organizations that require contractual data-processing terms for a TSS-hosted deployment can contact us at the address in Section 10.

Because your organization is the controller, questions about why the Visual is deployed, who may use it, and your organization’s own handling of identity and report data should be directed to your organization first. Section 6 describes the rights and controls available.

3. What we do not collect or store

No passwords. Sign-in happens on Microsoft’s own sign-in pages and those of your ArcGIS Online or ArcGIS Enterprise portal. Neither the Visual nor the Broker ever receives, transmits, or stores a password.
No Microsoft (Entra ID) tokens are stored. The Broker validates the Microsoft-issued token and then discards it. It is never stored.
No tokens on your device. The Visual holds session tokens in memory only for the duration of your report session. Nothing token-related is written to browser or Power BI storage.
No names, usernames, or email addresses in the Broker’s store. The Broker’s records contain no names, usernames, or email addresses. How records are keyed is described in Section 4.
No report data. Your business data and map content flow directly between your Power BI session and your ArcGIS services. They never pass through, and are never visible to, the Broker.
No analytics or tracking in the Visual. The Visual contains no advertising, analytics, or tracking components. License checks are recorded as described in Section 8.

4. What the Broker stores, and why

To let a signed-in user return to a report without signing in again, the Broker stores exactly one record per linked user per ArcGIS Online or ArcGIS Enterprise portal, containing:

A hashed identifier — a one-way hash of the user’s Microsoft Entra object ID. The raw ID is never stored in the Broker’s records.
A hashed organization identifier — a one-way hash of your organization’s Microsoft Entra tenant ID, used to manage your organization’s records.
The portal name — which ArcGIS Online or ArcGIS Enterprise portal the record belongs to.
One encrypted ArcGIS refresh token — the credential the user’s ArcGIS Online or ArcGIS Enterprise portal issued when the user approved the connection.
Timestamps — when the record was created or last renewed.

Encryption keys are held separately from the stored records, with access restricted.

5. Where the Broker runs

The Broker is deployed either (a) on your organization’s own infrastructure, inside your network, operated by your administrators — in which case TSS has no access to its stored records — or (b) as a TSS-hosted service on Microsoft Azure.

In the hosted case, records are stored in the Canada Central Azure region and protected as described in Section 4. For customers in the European Union and United Kingdom, transfers of records to Canada rely on the adequacy decisions those jurisdictions have made for Canada.

6. Retention, deletion, and your rights

A stored record exists only while the account link is live. It is deleted when any of the following occurs:

The user chooses Unlink Account in the Visual — a self-service deletion that removes the record immediately.
Your ArcGIS Online or ArcGIS Enterprise portal revokes the credential — for example on password reset, administrator action, or organization policy. The Broker deletes its record the next time the portal rejects it.
The credential expires (ArcGIS refresh tokens have a limited lifetime, typically around 90 days without renewal).
The customer offboards — for hosted deployments, all of an organization’s sign-in records are deleted within thirty (30) days of termination of service.

Your organization’s ArcGIS and Microsoft administrators additionally retain their own controls: disabling a user’s Microsoft account prevents any further exchanges immediately, and revoking the application registration in your ArcGIS Online or ArcGIS Enterprise portal invalidates all stored credentials for that portal at once.

Your rights. Depending on where you live, you may have rights to access, correct, delete, or object to the processing of your personal information. Because your organization deployed the Visual and controls the associated Microsoft and ArcGIS accounts, the fastest route for most requests is your organization’s own administrators — and deletion is always available to you directly through Unlink Account. For anything a hosted deployment stores that you cannot resolve those ways, contact us at the address in Section 10 and we will respond within the time required by applicable law, coordinating with your organization where it is the controller.

7. Third parties and subprocessors

The Visual and Broker interoperate with Microsoft (identity and Power BI platform) and Esri (ArcGIS services), each governed by your organization’s existing agreements and their respective privacy statements. When the Visual displays a map, your browser also loads basemaps, fonts, and icons directly from Esri’s servers; as with any web request, Esri receives technical information such as your IP address.

TSS does not sell stored records, and does not share or disclose them to any third party except: to your organization’s ArcGIS Online or ArcGIS Enterprise portal, which issued the credential, when obtaining session tokens; and to infrastructure providers acting on our behalf under contract, solely to host and secure the hosted service — currently Microsoft Azure (hosting, storage, and key management). Records may otherwise be disclosed only where required by law. We will update this policy if the subprocessor list changes.

8. License checks and logging

The Visual periodically confirms your organization’s license with TSS’s hosted service, which returns a signed confirmation including your organization’s Microsoft Entra tenant ID. The service keeps a record of each check under the hashed organization identifier described in Section 4. These records contain no information about individual users and are kept to administer licensing.

The hosted service does not otherwise keep request logs. If we temporarily enable diagnostic logging to investigate a fault, those logs may include technical information such as IP addresses, never include token values or passwords, and are deleted when the investigation is complete. Customer-hosted deployments log to the customer’s own infrastructure under the customer’s control.

9. Security

Communication is encrypted in transit, stored credentials are encrypted at rest with keys held separately, token values are never written to logs, and the sign-in flow is protected against misuse. Security issues can be reported to support@thesolutionstack.com.

10. Changes and contact

We will update this policy when the product’s data handling changes, and revise the effective date above. Material changes affecting hosted-deployment customers will be notified through the product or by email. Questions and requests (including access, correction, and deletion requests) can be sent to support@thesolutionstack.com, The Solution Stack Inc., Calgary, Alberta, Canada.