--- title: "Virto Forms Designer App: the brief for your IT team" description: "What stays in SharePoint and what VirtoSoftware stores, the scripts a published form loads, the delegated permissions the app asks for, custom script and the price." url: https://www.virtosoftware.com/virto-forms-designer-app-it-brief/ language: en-US last_modified: 2026-11-08T00:00:00+01:00 translations: de: https://www.virtosoftware.com/de/virto-forms-designer-app-it-brief/index.md --- # Virto Forms Designer App: the brief for your IT team Someone in your organization wants Virto Forms Designer App. These are the answers an IT and security review asks for first. For IT, security and procurement. Checked October 26, 2026. ## At a glance - List items stay in SharePoint - Form settings are stored on VirtoSoftware's Azure - Delegated permissions only - Its own Entra app, verified publisher - Admin consent for the whole organization - Publishing a form briefly needs custom script - Published forms load scripts from forms-app.virtosoftware.com - No SOC 2 or ISO 27001 of our own ## What the app does Virto Forms Designer App lets your team redesign the New, Edit and Display forms of SharePoint lists and libraries in a drag-and-drop designer, with separate layouts for users and groups. A published form is a page in that list. When people open it, the form reads and writes the list item through SharePoint itself. ## Where your data is - **List items and documents stay in SharePoint.** Neither VirtoSoftware’s server nor the form’s scripts send item data to VirtoSoftware. - **VirtoSoftware stores the form settings** on Microsoft Azure (West US 2): - the form’s layout, CSS and JavaScript; - the site address and the list ID; - the user logins and SharePoint group names used in the form’s permissions; - the names of the people who changed the form, and the app admins of each site; - the email address of the person who first opened the designer; - error logs: the action, the time and the error text, which can contain personal data. - **How long:** while a licence is active, these records stay until someone deletes the form or resets the list’s forms in the app. Error logs are kept for 90 days. When a paid licence or a free trial ends: - on day 60, [support@virtosoftware.com](mailto:support@virtosoftware.com) emails the person who first opened the designer and the person who bought the licence, with the deletion date; - the records are deleted on that date: 90 days after the licence ended, but never sooner than 30 days after the email; - if you buy or renew a licence before that date, nothing is deleted; - if we have no email address to write to, the records are deleted without notice one year after the licence ends; - a backup copy of the deleted records is kept for 30 days and then deleted automatically. - **Deletion on request:** to have the records deleted sooner, write to [dpo@virtosoftware.com](mailto:dpo@virtosoftware.com) with your SharePoint address, such as `contoso.sharepoint.com`. - **Data Processing Agreement** under GDPR Article 28: [request it](https://docs.virtosoftware.com/trust-and-security-center/request-dpa/data-processing-agreement/), no NDA needed. ## What a published form loads - Each time a published form opens, it loads JavaScript and CSS from `forms-app.virtosoftware.com` over HTTPS: the form engine, jQuery, SPServices and PnPjs. The form’s own layout is written into the page itself. - An update to those files on our server reaches every published form at once, without republishing. The files carry no Subresource Integrity hashes. - From the form’s page, our server receives only the requests for those files, with the usual request data: IP address, browser and referring page. - A form’s author can add their own JavaScript to the form. It runs on the form’s page like the rest of the form. ## What the app asks Microsoft 365 for All permissions are **delegated**. The app acts as the signed-in person and, in Microsoft’s words, “can’t access anything the signed-in user couldn’t access” ([Microsoft Learn](https://learn.microsoft.com/graph/permissions-overview#delegated-permissions)). It asks for no application permissions. | Permission | Microsoft’s description | Needs admin consent | | --- | --- | --- | | `openid`, `profile`, `offline_access`, `User.Read` | Sign users in, view their basic profile, keep access while they use the app | No | | `User.ReadBasic.All` | Read all users’ basic profiles | No | | `Sites.FullControl.All` | Have full control of all site collections | Yes | The app signs in through its own Entra app, **Virto Forms Designer**, `ad8772f8-f0b7-4877-937c-df242a4ac76e`, published by VirtoSoftware UAB as a verified publisher. Until an administrator consents, people see “Need admin approval”. You see what your tenant granted in \*\*Microsoft Entra admin center > Enterprise applications\*\* and can review or revoke it there at any time. ## Custom script - To publish, change or reset a form, a SharePoint administrator temporarily allows custom script on that site, for example with `Set-SPOSite -DenyAddAndCustomizePages 0`. SharePoint switches it back off within 24 hours ([Microsoft Learn](https://learn.microsoft.com/sharepoint/allow-or-prevent-custom-script)). - Published forms keep working after custom script is switched off again. ## Sign-in and control - People sign in with their Microsoft 365 work account. VirtoSoftware never receives a password. - A SharePoint administrator adds the app from [Microsoft Marketplace](https://marketplace.microsoft.com/en-us/product/WA200008088) to your app catalog. An administrator such as a Global, Cloud Application or Application Administrator then consents for the whole organization. A SharePoint administrator cannot give this consent. - The app checks its licence with `activation.virtosoftware.com` over HTTPS. ## Certifications, plainly | Question | Answer | | --- | --- | | SOC 2, ISO/IEC 27001 | VirtoSoftware has neither and does not plan to. | | Microsoft 365 Certification | No, and Virto Forms Designer App has not completed Microsoft Publisher Attestation. | | Hosting | Microsoft Azure. Azure’s own certifications cover the infrastructure, not VirtoSoftware’s processes. | | Your questionnaire | We fill in your organization’s own form. | More for legal and security reviewers, including the EULA terms and how to request our security policies under NDA: [Security & Compliance](https://www.virtosoftware.com/security-compliance/). ## On this page - What the app does - Where your data is - What a published form loads - What the app asks Microsoft 365 for - Custom script - Sign-in and control - Certifications, plainly - What it costs, and the alternatives ## What it costs, and the alternatives SharePoint lists already have forms. The question is what forms your team designs without code, with a layout for each group, cost. ### Microsoft 365 alone No extra cost - SharePoint’s built-in list forms - Power Apps list forms, within your Microsoft 365 licences ### Virto Forms Designer App $995 per tenant a year - Business plan, for the whole tenant - Enterprise on request - 30-day free trial [See plans and pricing →](https://www.virtosoftware.com/microsoft-365/virto-forms-designer-app/#buy-now) ### Build it yourself Your developers’ time - A SharePoint Framework form customizer per list - Upkeep each time Microsoft changes an API ## Questions from your review? Send us your security questionnaire, or book a call to go through the review with us.