Security

Last updated: November 1, 2026

You are trusting AP Guardian with a look at your payables, so here is exactly how the scan protects your data. If you have a question your IT or security team needs answered, email support@devalchemistlabs.com.

Read only, by design

• AP Guardian only reads from Business Central. Every request our product sends to Business Central is a read. There is no code in the product that writes, changes or deletes your data.
• Microsoft’s consent screen may say “read and write”, because Business Central does not offer a read only permission. The read only promise is enforced in our code: the part of AP Guardian that talks to Business Central can only send reads, and we check changes against that rule before release.
• You sign in with your own Microsoft account, so AP Guardian can only read what you can already see. There is no shared service account and no setup inside Business Central.

Nothing kept

• No database. The scan runs in memory on Cloudflare’s network while your page is open, and the result goes straight to your browser.
• Your sign in is sealed (encrypted with AES-GCM) into a secure, HttpOnly cookie in your own browser. It lasts at most 60 minutes, and choosing Disconnect deletes it. We keep no copy on our side, and we do not ask Microsoft for long lived access.
• Upload scans never leave your computer: the file is read inside your browser.
• Bank account details are never shown beyond the last 4 digits and never kept. When you connect, we do not ask Business Central for vendor bank account details. If an uploaded file includes them, they stay in your browser.

Connection and sign in

• AP Guardian only works over HTTPS: plain http visits are redirected, and both the site and the API tell browsers never to connect without it.
• Sign in uses Microsoft’s standard OAuth 2.0 authorization code flow with PKCE, and Microsoft returns the answer in a form post, so sign in codes never appear in a web address or a log.
• Cookies use the __Host- prefix, so no other site or subdomain can set or read them.
• Each page has a strict content security policy that limits where it can send data, and no other site can show our pages inside its own. On the upload page, the browser blocks the page and the background worker that reads your file from sending your data anywhere.
• Requests are rate limited to stop abuse.

Logs

Our logs hold counts and short error codes only, for example “scan read 530 entries” or “sign in failed, reason 3”. They never contain vendor names, invoice numbers, amounts or anything else from your books.

How we build it

• Every change we push is automatically run through over a thousand tests, including tests that results match known answers on test companies, and checked for software dependencies with known high or critical security issues.
• We review changes before release for read only access, for secrets, and for any customer data reaching the logs.

Removing access

• Choose Disconnect at any time to delete your sign in from your browser.
• Your Microsoft Entra admin can remove AP Guardian completely under Enterprise applications at any time.

Reporting a problem

If you think you have found a security issue, please email support@devalchemistlabs.com. We will reply within 2 business days and keep you informed until it is fixed.