Your data stays where it is.

Read-only, enforced

The extensions read D365 through its OData API with the signed-in user’s own session. They only send read requests (HTTP GET): no create, update, delete or posting. The user’s security roles apply to everything they read.

Security X-ray also calls two D365 services that only answer questions and change nothing: which pages the user can open (GetAccessRights) and which configuration keys are switched on (GetConfigKeysStatus). The build check allows exactly these two and no other.

In Config Diff and Security X-ray a check in the build fails if any code outside the read-only D365 client makes a network request, uses another HTTP method or writes HTML. D365 is read from inside the D365 tab itself; the extension’s own pages have a content security policy that blocks all network access, except the licence server in licensed builds.

Processed in the browser

Orders, items, customers, vendors, configuration values, users, roles and permissions are read, compared and shown in the browser. They are never sent to PW Scan IT BV or to any third party. Config Diff snapshots are stored in the browser (IndexedDB) and leave it only when the user exports a file; Security X-ray snapshots are only ever files the user saves.

Fields that look like secrets (passwords, client secrets, connection strings, API keys) are redacted the moment they are read, before anything is stored, shown, exported or logged.

What the licence check sends

The paid extensions (Supply Chain X-ray, Config Diff, the Security X-ray workspace and CMR consignment note) check their licence with licence.pwscanit.com. It is the only server they contact, and no D365 data is ever part of the check. These are the only fields that are ever sent, and the extension refuses to send any other:

Field	What it is
email	The email address entered to start a trial or sign in
key / code	The licence key, or a 6-digit sign-in code from an email
product, version	Which extension, and its version
installId	A random id created once per browser install
userHash	Optional. A one-way hash of the D365 user id with a random salt that never leaves the browser
hostname	The D365 environment name, e.g. contoso.operations.dynamics.com
token	The signed licence token issued earlier

Licence tokens are signed with Ed25519 and checked in the browser, so the extension keeps working offline for up to 14 days. Nothing else is sent: no page addresses, no company ids, no order or item numbers, no user names, no telemetry. The free Inventory Hover makes no licence check at all.

Browser permissions

Permission	Why
D365 sites	To read D365 with the user’s session. Microsoft-hosted D365 addresses only; other addresses (proxies, custom domains) one at a time, after the user allows them.
storage	Settings, and for paid extensions the install id and licence token.
scripting	CMR consignment note: to connect to D365 tabs that were already open, and to run on extra D365 sites the user allows.
downloads	CMR consignment note, optional: asked only when the user turns on saving a PDF of each printed CMR.
alarms	Paid extensions: re-check the licence about once a day.
Licence server	Paid extensions: licence.pwscanit.com, the only non-D365 address they may contact.

Managed deployment

Organisations can install the extensions for their users with Edge or Chrome policies (forced install, allow-listing by extension id). Ask us for the extension ids and a short deployment note.

Each user manual has a chapter on installation and company-wide rollout, and one on security and privacy: Supply Chain X-ray, Config Diff, Security X-ray, CMR consignment note (PDF).

This page explains how the extensions are designed to handle data. It is a description, not a warranty; what we guarantee and what we are liable for is set out in our terms of use.

Report a security issue

Email support@pwscanit.com with “Security” in the subject. We answer within one business day.