Security and data
Last updated 23 October 2026
InXtend apps are being designed to run inside your Business Central environment and keep your business records there. This page lists what will leave it.
Draft. InXtend apps aren't on sale yet. This page will be updated before they are.
What stays in your tenant
Customers, vendors, items, documents, ledgers and other business records stay in your Business Central database. InXtend apps are designed not to copy them to InXtend or to third parties, except for what's listed below.
What leaves your tenant
| Data | Why | Where it goes |
|---|---|---|
| License check: your Entra tenant ID, environment name, app ID and version, and the number of licensed users where a plan is priced per user | To confirm the subscription is active. We plan to cache the result in the app, with a grace period so a service outage doesn't interrupt your work. | InXtend's license service. We'll name its hosting provider and region here before the first app is offered. |
| Technical telemetry: event IDs, durations, error codes and messages, app version, and the context Business Central adds to every signal, such as tenant ID, environment name, company name and a pseudonymous user ID | To find and fix failures and slow operations | InXtend's Azure Application Insights resource, through Business Central's standard telemetry |
| Support requests: what you send us, such as contact details, screenshots, error text and files | To answer your request | InXtend's support mailbox. We access your environment only if you grant access for a specific case. |
Our own telemetry events are designed not to include document contents, amounts, or customer, vendor or contact names, addresses or email addresses. Business Central adds standard context of its own, listed above, and some platform error messages can include values from the record involved. Our privacy notice covers this data. You can also send the same telemetry to your own Application Insights resource from the Business Central admin center.
How the apps are built
- The apps are designed to extend Business Central through published events and interfaces, without modifying standard posting routines.
- Each app will ship with permission sets scoped so each role gets only the access the app needs.
- Each app and update will be submitted to Microsoft's technical validation before it's published on AppSource. That validation is not a security certification.
Report a vulnerability
Email security@inxtend.com with a description, steps to reproduce and the affected app and version. Machine-readable details are in our security.txt.
- We'll acknowledge your report and keep you updated while we investigate.
- Please give us reasonable time to fix the issue before disclosing it publicly.
- Only test against Business Central environments you own or are authorized to test. Don't access, change or delete other people's data, and don't disrupt services.
- We don't run a paid bug bounty.