Security
Security architecture, with the data flows named.
What moves, where it goes, and what you control — stated per flow. For a security questionnaire or procurement review, contact us and we answer against this document.
Data flows.
| Capability | Evidence | Scope |
|---|---|---|
| Local indexing | Runs on your machine. Application metadata and code indexes stay local; nothing is transmitted for indexing. | Version 3.0 |
| Licensing and activation | Activation exchanges license key + a one-way machine hash with the licensing service over HTTPS; records hold entitlements, not machine identity. | Version 3.0 |
| Product updates | Update metadata and packages download over HTTPS from our update channel; packages are hash-verified before application. Version pinning is available for managed fleets. | Version 3.0 |
| Telemetry | Off unless enabled. When enabled, only the documented operational events are sent — never source code, file paths, or prompts. | Version 3.0 |
| Configured AI provider | Prompts travel directly from your desktop to your configured provider under your agreements. Provider, model, and retention terms are yours. | Version 3.0 |
| Git and system credentials | Core does not collect or store source-control credentials; the system Git client may use the credential helpers configured on the machine. | Version 3.0 |
| Target D365 environments | Build, sync, and deploy actions run against the environments you configure, with the permissions those environments require. | Version 3.0 |
| Support bundles | Uploaded only when you choose; quarantined, reviewed manually, never publicly addressable. | Version 3.0 |
| Contact and sales forms | Form submissions create a durable lead record and staff notification; contents never go to analytics. | Version 3.0 |
| Portal authentication and billing | Magic-link sign-in (no stored passwords), server-side organization authorization; payment card data is held by Stripe, not by Core. | Version 3.0 |
Distribution and updates.
Assurance status.
Exact states — never generic badges.
- SOC 2: Not certified. Readiness work in progress; we will name the auditor, scope, and date when an engagement exists.
- Accessibility: WCAG 2.2 AA audit work is performed in the engineering program; a formal conformance report does not exist yet — request the current state through the contact page.
- Penetration testing: no completed third-party test to cite yet.
Report a vulnerability.
Email [email protected] with the subject Security report: what you found, steps to reproduce, and the impact you see. Test only against your own installation and accounts — never other customers' data, and no service degradation. Good-faith research followed by a private report is welcomed.
Core Studio is an independent product for Microsoft Dynamics 365 Finance & Operations. It is not affiliated with, endorsed by, or sponsored by Microsoft. Microsoft and Dynamics 365 are trademarks of the Microsoft group of companies.