Is the following an appropriate question for Security.SE? If not, can you suggest the right place?
When viewing message in Outlook 2013 (getting it's mail from Exchange 2013) there is an small link in near the header with "Bing maps" link. After clicking on that link the app does some thinking, emits a message like "we think we found an address", and then shows an embedded map of the address found.
(click through picture for MS page on Outlook apps)
Going to Outlook's Manage Apps page connects to the Exchange server where one can eventually find some info on the Bing Maps app, and enable/disable it. Under permissions it says
"When you click this app, it will be able to access limited information in the active message, such as phone numbers, postal addresses, or URLs in the message body or subject. The app may send this data to a third-party service."
My question is: Where exactly does the "is this an address?" calculation take place -- Outlook, local Exchange, Microsoft HQ, or undisclosed 3rd party service -- and what are the information and/or security risks associated with it?
My concern is that when clicking on this link the content of the message (and it's headers? and other messages in the thread? and my current location? ...?) is sent off premise, e.g. beyond our locally hosted and secured Exchange server to Somewhere Outside, perhaps many parties.
I'm just an end user, and have nothing to do with the our Exchange server. I'm not automatically against an app that (possibly) shares information externally. I just want to know how it functions, so I can decide for myself when it's appropriate to use or not use the feature. 99% of the time for my email it won't matter. However I have colleagues who deal with things like personal medical info of others for whom this might be a very big concern.