Security and data
Where Weave runs, how it reaches your two systems, who can see what, and what it keeps.
Where it runs
The application and its scheduled jobs run on Vercel in Frankfurt (fra1). The database is PostgreSQL on Neon, in Frankfurt (eu-central-1). Every provider is on the sub-processors page.
Signing in to Weave
Microsoft work accounts only, through Entra ID. Weave holds no passwords.
Signing in proves an address and grants nothing. A person sees a company's data only after an administrator has added them to it, as an admin, an operator or a viewer. Viewers read, operators act, and only admins change settings.
One company, one scope
Every query that runs for a customer is restricted to that customer in the data-access layer, not by convention. A new customer is rows in the database, not a new deployment.
Reaching Business Central
Weave signs in as its own Microsoft Entra application, with the permission sets you assign it, and talks only to API pages its own extension publishes. Every posting in the ledger names Weave's application user, never a person for a machine's work.
Reaching the warehouse
The clients that read Ongoing can only read: one sends nothing but GET, the other carries a fixed list of read operations. Writes go through one separate file of named operations (put an article, put a purchase order, put an order and a few more) with its own credential, and no caller can pass it a verb or a path.
Nothing is deleted in the warehouse. The one cancel is a sales order a person deleted in Business Central before picking started, and only with that switched on.
Nothing written by accident
Anything run by hand is a dry run unless confirmed, and writing to a production connection takes a second, separate confirmation. The mistake worth guarding against is never running the job, it is running it against the wrong warehouse.
Credentials
Credentials for the connected systems are encrypted at rest with AES-256-GCM, and the key that opens them is held apart from the database. They never appear in command lines, committed files or logs, and they are redacted before anything reaches the audit log.
The record
An audit log of every request Weave made to either system and the answer it got. Every call from outside, such as Business Central asking whether the warehouse has started an order, is authenticated with a key per customer and logged.
What it keeps
What Weave needs never to post twice and to explain recent work: warehouse events, postings, exceptions and the audit log. Business Central keeps the posted documents and Ongoing the warehouse history.
Records Weave has finished with are deleted after a retention period you set, 90 days by default and never under 30, once you switch deletion on. Sales history used to check old returns is kept up to three years from the sale.