Security & Privacy

The uploaded file is parsed and evaluated by deterministic, rule-based logic running locally on the server - no AI is involved in the analysis itself. Solutions follow a clearly defined structure with little to no room for interpretation, which is exactly the kind of task that doesn't benefit from AI: fixed rules deliver a more precise, reproducible result. Your solution content is never sent to OpenAI, Anthropic, or any other external API service.

• The uploaded .zip and the solution files extracted from it are deleted immediately after the analysis - they only exist on the server for the duration of processing (typically seconds).
• The generated reports (PDF/Word/Excel) and aggregated metrics (number of fields/entities etc.) remain stored for a limited time (default: 7 days after upload) so the report can be downloaded after payment. If you purchase a report, this period restarts from the date of purchase, so you always have the full period to download what you paid for. After that, automatic deletion occurs.
• Only with explicit consent (a checkbox at upload, not ticked by default): an anonymized log entry with technical anomalies (e.g. new XML structure patterns, warnings, frequency of triggered rules) is stored for product improvement. Data such as the solution name, publisher name, or the content of fields, entities or descriptions is never recorded.
• Pipeline subscription: only if you tick the box when subscribing (it is unticked by default) do we store, from the runs of your subscription, an anonymized log entry with technical anomalies (e.g. new XML structure patterns, warnings, frequency of triggered rules) for product improvement, as with an upload on the website. Data such as the solution name, publisher name, or the content of fields, entities or descriptions is never recorded, and the entry has no link to your account. It is deleted after 30 days. You can change your choice at any time by writing to consulting@d365audit.de.
• Fit Check: The result is calculated in your browser. Unless you opt out on the page, we receive the ticked answers and the result anonymously - no IP address, no cookie, no time of day, none of your free-text entries, numbers only as rough ranges. If you then send a contact request, it notes that it came from the Fit Check. These entries are deleted after twelve months.
• For evaluating our advertising and referrals we count per day which channel visitors came through (for example search, ads, LinkedIn) and from which website, shortened to the referring domain. We only store the day, the channel or domain and the count, without cookies, without IP addresses and without any link to a person.
• To protect against abuse, the server counts requests per IP address. These counters are deleted after two days at the latest.
• To protect our mail domain against spoofing, we evaluate the DMARC aggregate reports sent by receiving mail providers. For each report we store the reporting provider, the period and our published policy, as well as the IP addresses and server names of the mail servers that sent under d365audit.de, with count and check result – no content, subjects or recipient addresses. The data is deleted after 90 days (Art. 6(1)(f) GDPR).
• Solution comparison: so that you can compare a second version and reopen the comparison or download it as PDF and Excel, we store with the analysis, for both versions, the name, version and publisher, the names and labels of their components and of the third-party solutions they require, their technical properties (for example data type, required level, columns of a view, privileges of a role, navigation targets, names of script functions and flow steps) and which rules were triggered where. Descriptions and other free texts only as fingerprints, values in filters only if they are numbers or yes/no, otherwise also as fingerprints. No code and no records. Of the second version only the one compared last. The comparison result, the PDF and the Excel file are not stored, they are created anew on every request. Everything is deleted together with the analysis, the uploaded files right after the analysis.
• Solution comparison, usage: for each comparison we store the day, the approximate number of components of both versions (rough size classes only), what percentage of their components both have in common (rounded down to tens), whether the comparison is unusual and whether the first analysis was purchased, without names, without a link to the analysis and without a link to you. This shows us how the free comparison is used (legitimate interest, Art. 6(1)(f) GDPR). It is deleted after 90 days.
• Payment data is processed exclusively by Stripe (Stripe Checkout), never by us.
• Emails after a purchase: We use your email address to send the report. If you leave the pre-selected box ticked, we send one reminder about one day before the report is deleted (part of the contract, Art. 6(1)(b) GDPR). Only if you tick the second box yourself do we ask you once for feedback, about two days after the purchase (consent, Art. 6(1)(a) GDPR). You can withdraw it at any time with the link in the report email or by writing to consulting@d365audit.de. Your email address is deleted together with the report. Feedback answers are stored for twelve months, without your email address and without a link to your purchase.
• Pipeline subscription: if you cancel in Stripe's customer portal and give a reason there, we store the reason you chose together with the day of cancellation, the plan, the number of months the subscription ran and how it ended (at the end of the period or immediately, by you or because a payment failed), without your email address, without your name and without a link to your account. If you write a comment there, we do not store it, only that there was one. This shows us what we should improve (legitimate interest, Art. 6(1)(f) GDPR). It is deleted after twelve months.
• Pipeline subscription: for each completed month we store how many checks of your quota were used, together with the month, the plan, the price, the month number of the subscription, how many days it ran that month and whether it ended that month, without your email address, without your name and without a link to your account. This shows us which plans suit our customers (legitimate interest, Art. 6(1)(f) GDPR). It is deleted after 36 months.
• Pipeline trial: if you request a trial, we use your email address to send you the link. Only when you open it do we create the trial account with your email address; it is deleted 30 days after the last check, at the latest after 90 days. So that there is only one trial per company and per publisher, we also store a fingerprint of the domain of your email address and of the publisher of the first solution checked, not in plain text and without a link to your account (legitimate interest, Art. 6(1)(f) GDPR). It is deleted after 24 months.
• Contact form requests (name, email, message) are forwarded by email to consulting@d365audit.de.

EU (Frankfurt region). Uploaded solutions never leave the server in Frankfurt; reports leave it only as your download or as an email to you. Payment processing by Stripe, delivery via Cloudflare and (only with your consent) analytics by Google Analytics are subject to their respective privacy terms.

Data in transit is always encrypted via HTTPS/TLS.

We use Google Analytics (GA4) with IP anonymization and Google Ads to measure advertising conversions - but only after you explicitly agree in the cookie banner. If you decline or ignore the banner, no Google script is loaded and no analytics cookie is set. One strictly necessary cookie stores your choice. Marketing cookies are not used.

Together they give the full picture – we do not replace the Solution Checker, we answer a different question. The checker asks: “Is the code clean?” We ask: “Can a new team take over, maintain and migrate this solution?”

In short: the Solution Checker reviews the quality of the code. We assess the state of the solution as a whole – and deliver the document you can decide on.

Apps built on Microsoft Dataverse (Sales, Customer Service, Field Service, similar Customer Engagement apps, and Power Apps). Business Central is not covered, because it uses a fundamentally different extension model (AL/.app) with no comparable solution export.

The format of the solution export (customizations.xml) is the same regardless of the hosting model. Our assessment works in both cases.

None. See above. We never connect to your environment; we only work with the solution package containing your customisations. Your sensitive customer data can never reach us.

For a partner package we store the email address given at purchase, the package, the vouchers, the purchase date and the amount paid. We need this to send the vouchers and to send them again if an email goes missing. Payment details, billing address and VAT ID are handled by Stripe, which also issues the invoice. Legal basis is the performance of the contract (Art. 6(1)(b) GDPR).

Whoever redeems a voucher uploads and buys like any other customer; the partner never sees that analysis, and we do not tell the partner who redeemed a voucher.

Order and vouchers are deleted 30 days after the vouchers expire, i.e. about 25 months after purchase. Invoices remain with Stripe for the statutory retention period.

The reference programme is entirely voluntary: you receive the report free of charge and in return allow us to name your company as a reference. It plays no part in the analysis itself.

What we store: company name and address, the name of your contact person, the company website, the business email address you provide, and the logo you upload. Nothing else. Legal basis is your consent (Art. 6(1)(a) GDPR).

What is published: only your company logo, linked to your website. Never your name, your email address or anything from your analysis.

Why a business email address: the address must be on the domain of the company website you provide, and we send a confirmation link to it. This is how we check that a reference is genuinely issued by the company itself.

Withdrawing consent: you can withdraw at any time with a single click on the link in the confirmation email, without giving reasons and without contacting us. We then remove the logo from the website. The report already delivered stays with you.

How long we keep the data: as long as the reference is active. After a withdrawal the logo file is deleted immediately; the remaining entry is anonymised after 90 days, so that we can still prove that and when a withdrawal happened. Archived references are anonymised 90 days after archiving; only the domain is kept. A registration that is never confirmed is deleted completely after 30 days, including the uploaded logo.

The logo is not publicly retrievable until it is published on the site; until then it is stored internally only. Data is deleted after withdrawal.

Please send it by email to consulting@d365audit.de, with the steps needed to reproduce it.

Please do not run tests that disrupt the service or touch other people's data, and give us time to fix the issue before you publish it. We confirm receipt and get back to you as soon as we have checked it.

We do not run a paid bug bounty programme. We review every report and credit valid findings on request.

Machine-readable contact details: /.well-known/security.txt (RFC 9116)