When you're on the install page for a Live App, you'll see some notes about what information it does and doesn't have access to. Here, for your peace of mind, are some additional details on what each of those notes means:
Stores all data in Quip: This Live App and its contents live entirely inside your organization's Quip installation. It never communicates with external servers, or accesses external APIs.
Can access and store data on third-party servers: Some third-party Live Apps communicate with external servers in order to sync data in Quip with data from other services. For example, the Altify Live App connects with Altify's servers so that users can view and edit Atlify data in real time from within a Quip doc.
- For your organization's security, Live Apps are never allowed to access the contents of your company's documents, or any other data from your company's Quip site.
- All Live Apps have access to the names of your team members, their profile pictures, and their IDs, but nothing else about them. This is necessary for Quip's collaborative elements, like mentions and notifications, to work properly.
If you want to know exactly which servers are being communicated with, you can check out a full list of them by clicking the “See server addresses” link on the install page.
Requires [name of service] account: For some apps that communicate with external services, your team members will need to have an account with those services in order to use the app. They'll be prompted to log in the first time they insert the app in a Quip doc.
AppExchange security approved: All applications in the AppExchange must go through a mandatory periodic security review. Salesforce assesses the security posture of partner offerings to ensure that applications published on the AppExchange follow industry best practices for security, and to promote trust between partners and customers.
Has not received a third-party security audit: You may see this note in cases where developers have set up a URL through which to distribute their app, but haven't formally published it to the AppExchange yet. Use your best judgement here, and make sure you absolutely trust the developers before installing.