Security & Data Handling
Last updated: July 18, 2026
This statement describes the security controls, data handling practices, and compliance posture of the AMReport Reliability Performance Review application (the "Service") operated by ERP Automated. The Service retrieves maintenance and inventory data from customer Microsoft Dynamics 365 Finance & Operations environments, processes it into reliability reports, and presents it through a secured multi-tenant web application.
Security is designed in layers: identity and access control at the edge, encryption of data in transit and at rest, logical isolation between tenants, and a complete audit trail of sensitive operations.
The Service reads Asset Management and Inventory data entities from the customer's Dynamics 365 environment — work orders, work order jobs, maintenance requests, maintenance schedules, assets, asset criticalities, bill of materials, asset counters, released products, product translations, item coverage settings, warehouse and site on-hand inventory, work order line schedules, and posted project transactions. All access to the source environment is read-only; the Service does not modify or delete data in the customer's D365 tenant.
Derived data — reliability reports, inventory snapshots, schedule-change records, audit logs, and customer configuration metadata — is stored in the Service database. The source D365 data itself is not persistently stored; only the processed snapshots and report outputs derived from it are retained.
The Service is hosted on managed cloud infrastructure. Application compute, the database, and file storage are co-located in a single cloud region. Customer data is not replicated across regions except as required for durability by the underlying managed database provider. The active region is documented in the customer's service agreement; customers subject to data-residency constraints should confirm the region before onboarding.
In transit: All network traffic between the user's browser, the application backend, and the customer's Dynamics 365 environment is encrypted using TLS 1.2 or higher. HTTP traffic is refused at the edge. OAuth tokens exchanged with Microsoft Azure are transmitted over HTTPS only.
At rest: The application database enforces encryption at rest using AES-256. Dynamics 365 access tokens, refresh tokens, and per-customer service-principal secrets are stored encrypted and are only decrypted in memory at the moment of use. File storage (uploaded imports, generated assets) is served from encrypted object storage.
Report records and inventory snapshots are retained for the lifetime of the associated customer profile so multi-period trend analysis remains available. When a customer profile is deleted, or a customer requests deletion, associated reports, snapshots, schedule-change records, and D365 connection tokens are removed. Audit log entries are retained for security monitoring and compliance purposes. D365 connection tokens are revoked and purged immediately upon disconnection.
The Service relies on managed cloud infrastructure (compute, database, file storage), an email delivery provider, and Stripe for payment processing. Each sub-processor is bound by data-processing agreements and provides its own security and compliance program. Customer D365 data is never shared with, or accessible to, advertising or analytics providers.
The Service is multi-tenant: multiple customers share the application infrastructure, but each customer's data is logically isolated and cannot be accessed by another customer.
Every stored record that belongs to a customer carries a customer identifier. Database-level row-level security (RLS) policies enforce that a non-administrative user can only read, update, or delete records whose customer identifier matches the customer profile they are linked to (via client email, contact email, or company-administrator ownership). Write and delete operations are further restricted to administrators and the owning company administrator.
Each customer's Dynamics 365 connection uses that customer's own Azure AD service principal or delegated authorization, scoped to that customer's D365 tenant. The Service does not use a shared D365 credential across customers. When fetching data, the Service targets the customer's configured environment URL and company; it cannot reach a different customer's tenant.
To preserve Microsoft multiplexing licensing compliance, non-administrative users viewing live D365-sourced data must verify a Microsoft Entra ID identity whose tenant matches the connected D365 environment's tenant. Users whose identity cannot be verified or whose tenant does not match are blocked from live data access.
User authentication is managed through the platform identity provider, which supports email/password, Google, and Microsoft (Entra ID) sign-in. Passwords are never stored in plaintext; they are hashed using industry-standard one-way algorithms by the identity provider.
The Service enforces three roles: site administrators (manage customers, imports, reports, and all user accounts), company administrators (manage their own company profile, team emails, and report schedules only), and clients (view their linked company's dashboard and reports). Administrative routes are guarded server-side and client-side; a non-administrator cannot reach administrative endpoints.
Internal access to customer data is restricted to authorized personnel who require it to operate the Service, and is granted on a least-privilege basis. Production database access is limited to a small number of named operators and is logged. Customer D365 credentials (tokens, secrets) are never visible to operators — they are stored encrypted and used only programmatically during data retrieval.
Connections to customer D365 environments use per-customer Azure AD app registrations (service principals) or delegated user authorization. Secrets are stored in a managed secret store and referenced by name in application code; they are never committed to source control or logged in plaintext.
All sensitive operations are recorded in an immutable audit log. Each entry captures the actor's user ID, email, role, the action performed, the target customer, the outcome (success, denied, or error), and a timestamp. Logged actions include:
• Dynamics 365 data fetches and dashboard refreshes
• D365 connection authorization and revocation
• Entra ID identity verification attempts
• Report generation, publication, and scheduled delivery
• Subscription and billing changes
• User invitation and role changes
• Customer profile creation and modification
Denied actions (for example, an attempt to access another customer's data) are logged with outcome "denied" and are available for security review. Access to the audit log itself is restricted to site administrators.
Application secrets — D365 service-principal secrets, Azure tenant credentials, Stripe keys, and webhook signing secrets — are stored in a managed secret store and injected into the runtime environment as encrypted environment variables. Secrets are rotated on a regular schedule and immediately upon personnel turnover or suspected compromise.
All external data ingestion is validated. File-based imports are restricted to platform-hosted file URLs using an allowlist that blocks localhost, internal hostnames, private and link-local IP ranges, and non-HTTPS schemes. D365 OData responses are validated against expected entity schemas before processing.
In the event of a confirmed security incident, ERP Automated will notify affected customers without undue delay, describe the nature and scope of the incident, and outline remediation steps. Customers can request incident details by contacting the security address provided in their service agreement.
The Service is hosted on managed cloud infrastructure whose underlying provider maintains independent third-party attestations including SOC 2 Type II and ISO/IEC 27001. These attestations cover the infrastructure layer (physical security, availability, processing integrity, confidentiality, and privacy) on which the Service runs.
The controls described in this statement — encryption, tenant isolation, least-privilege access, audit logging, and secrets management — constitute the application-layer security program. ERP Automated is pursuing its own SOC 2 Type II assessment to formally attest to these controls; current and prospective customers may request the latest status by contacting us.
The Service integrates with Microsoft Dynamics 365 and Microsoft Entra ID using standard OAuth 2.0 and OData interfaces. It follows Microsoft's guidance for multi-tenant SaaS applications, including per-customer service principals, read-only data access, and Entra ID tenant-matching for report viewers.
The Service is designed for high availability on managed infrastructure with automatic health checks and failover. The managed database provides point-in-time recovery and automated backups. In the event of a regional outage, the Service can be restored to a secondary region; customer D365 source data remains untouched and available in the customer's own D365 tenant throughout.
Questions about this Security & Data Handling Statement, or requests for compliance documentation, should be directed to the security contact provided in your service agreement.
© 2026 AMReport. All rights reserved.