PathixDataverse Forensics
Security architecture · Compliance posture

Customer-hosted.
Metadata-only. Passwordless.

Pathix runs entirely inside your Azure subscription, reads metadata only, and authenticates without long-lived secrets. Granting a user access to Pathix does not extend their access to any Dataverse record they could not otherwise view.

Read the whitepaper (PDF)security@pathix.app
● TL;DR
Security in 60 seconds
  • Customer-hosted
    Runs in your Azure subscription. Vendor has no production infra that processes customer data.
  • Metadata-only
    No path to retrieve or persist customer record values, enforced in code: no generic Retrieve, no value/content/data column. Stores administrative principal identifiers (names, UPNs) in the customer's own tenant; no business record content anywhere in the schema.
  • Passwordless auth
    Entra ID + MSAL for users, system-assigned Managed Identity for services. No long-lived secrets.
  • BYOK AI
    Optional. Your provider, your keys. Vendor never proxies, brokers, or stores AI credentials.
  • Customer-owned telemetry
    Application Insights inside your subscription. No shared logging plane.
  • Open architecture
    Bicep template and full coverage detail in /how-it-works. Nothing about the system is hidden. A CycloneDX SBOM is generated for every release, available on request.
Continue below for the full architecture, identity model, cryptography, application-security mitigations, telemetry catalog, compliance mapping, shared-responsibility matrix, and disclosure policy.
Foundational commitments

Four design choices the rest of the page builds on.

The Pathix security posture is shaped by four architectural commitments. Each one narrows the surface that the platform introduces into your environment, and each one is enforced in code, not just policy.

01 · CUSTOMER-HOSTED
Runs in your subscription. Not ours.

Pathix is delivered as an ARM/Bicep template you deploy into your own Azure subscription. The vendor maintains no production infrastructure that processes customer data.

02 · METADATA-ONLY
Built so record data can't be retrieved or stored.

The metadata-only boundary is enforced at the SDK wrapper, the database schema and code review. Pathix has no generic Retrieve method, no value/content/data column, and no path for record bodies to enter the system.

03 · PASSWORDLESS
Entra ID for users, Managed Identity for services.

No long-lived secrets, client passwords or API keys are required for the platform to operate. Service-to-service auth uses system-assigned Managed Identity bound to the Container App.

04 · BYOK AI
Optional, with keys and endpoints you own.

AI features run only against an AI provider you configure (Azure OpenAI, OpenAI or Anthropic). The vendor never proxies, brokers or stores AI provider credentials. AI-proposed edges are labelled AI-derived and never override a deterministic finding.

Deployment model

Inside your subscription, with egress you control.

Pathix is delivered as a Bicep template that provisions a single set of Azure resources in a region you choose. The vendor has no production database, file storage or compute that processes customer data.

CUSTOMER AZURE SUBSCRIPTION · REGION OF YOUR CHOICEPathix instanceDeployed via pathix.bicepWeb App & APIASP.NET Core 10 · Container AppScan OrchestratorBackground metadata extractionAzure SQL DatabaseMetadata · findings · configAzure Key VaultLicense · integration secretsManaged IdentitySystem-assigned · no secretsApplication InsightsCustomer-owned telemetryPathix Scanner roleRead-only · metadata privilegesDataverse{environment}.crm.dynamics.comSolutionscustomizationsPlugins · FlowscomponentsRoles · Privilegessecurity modelBusiness recordsnever readOUTSIDE CUSTOMER TENANTMicrosoft Entra IDlogin.microsoftonline.com · OAuth/PKCECustomer-chosen AI providerAzure OpenAI · OpenAI · Anthropic · BYOKLicense server (Pathix)Token validation · offline optionVendor never sees:· customer record data· customization names or IDs· tenant identifiers (beyond license)· AI prompts or AI provider keys· operational logs
COMPUTE
Azure Container App
STORAGE
Azure SQL Database
SECRETS
Azure Key Vault
IDENTITY
System-assigned Managed Identity
TELEMETRY
Application Insights · customer-owned
TENANT ISOLATION
Azure subscription boundary · no shared layer
DATA RESIDENCY
Region of your choice · Azure-native
AIR-GAP SUPPORT
License validation + error reporting local, no phone-home · deployable in restricted-network and disconnected enclaves
Data handling

What Pathix reads. What Pathix never touches.

The metadata-only commitment is the foundation of the rest of the compliance posture. It is enforced through three independent architectural layers, not policy alone.

CATEGORY
EXAMPLES
PATHIX ACCESS
Structural metadata
Table and column definitions, relationships
Read
Behavioral configuration
Workflow, plugin and flow definitions
Read
Security configuration
Roles, privileges, principals, team memberships
Read
Event metadata
Audit event tuples (actor, target, time; values stripped)
Read (planned)
Customer business records
Account, contact, opportunity and custom records
No access
Audit log payloads
Before/after values from record changes
No access
Embedded record values
Hardcoded GUIDs in workflow XAML or formulas
Discarded post-parse
LAYER 01
SDK wrapper
Compile-time enforcement

All Dataverse calls route through one internal wrapper class with a deliberately constrained method surface (GetEntityMetadata, GetSecurityRoles, GetWorkflowDefinitions). No generic Retrieve. No raw organization service. No other component may reference the Dataverse SDK directly, and an architectural fitness test in CI enforces this at build time: a violation blocks the merge.

LAYER 02
Schema constraints
No column can hold customer data

The Pathix relational schema contains no generic value, content or data columns. Customer-authored content like workflow XAML and form JavaScript is processed in memory during a scan and is not persisted. Derived structural outputs are stored. Raw bodies are not.

LAYER 03
Code review
Mandatory checklist

Every change touching Dataverse ingestion is reviewed against an explicit checklist: does this introduce a new path for record data, expose values in logs/errors/telemetry, or surface customer record contents in the UI?

Identity & access

Passwordless, least-privileged, auditable before assignment.

End-user authentication uses Microsoft Entra ID via OAuth 2.0 with PKCE. Service-to-service authentication to Dataverse uses a system-assigned Managed Identity. The required Dataverse privileges ship as a single managed solution containing one role: Pathix Scanner.

AUTHENTICATION
End users

Microsoft Entra ID via MSAL · OAuth 2.0 Authorization Code with PKCE. MFA, conditional access and identity protection apply transparently from your tenant.

Service to Dataverse

System-assigned Managed Identity bound to the Container App. No client secrets, no certificates, no connection strings carrying credentials.

Internal RBAC

Authorization is enforced at the API layer. The UI reflects but does not enforce decisions. Provisioning, role changes and auth events are emitted to your Application Insights.

The Pathix Scanner role: all 31 Read privileges · the complete read-only footprint

Every privilege the Pathix Scanner role requests, exactly as it ships and as published in the security whitepaper. All 31 are Read, all at Organization scope, and all on configuration and metadata entities: plugin and SDK registration, automation, the security model, solutions, and table, column and relationship metadata. Not one grants read on a business-data table like account or contact. The metadata-only boundary, made concrete.

#
PRIVILEGE
ENTITY / SURFACE
1
prvReadPluginAssembly
pluginassembly
2
prvReadPluginType
plugintype
3
prvReadSdkMessage
sdkmessage
4
prvReadSdkMessageProcessingStep
sdkmessageprocessingstep
5
prvReadSdkMessageProcessingStepImage
sdkmessageprocessingstepimage
6
prvReadWorkflow
workflow
7
prvReadWebResource
webresource
8
prvReadSystemForm
systemform
9
prvReadSavedQueryVisualizations
savedqueryvisualization (privilege name is plural)
10
prvReadCustomization
customization umbrella: sitemap, ribboncustomization, customcontrol
11
prvReadQuery
savedquery (named prvReadQuery, not prvReadSavedQuery)
12
prvReadappaction
appaction (privilege name is lowercase)
13
prvReadmsdyn_dataflow
msdyn_dataflow
14
prvReadconnectionreference
connectionreference
15
prvReadServiceEndpoint
serviceendpoint: service endpoints and webhooks (by contracttype)
16
prvReadCanvasApp
canvasapp
17
prvReadPublisher
publisher
18
prvReadCustomAPI
customapi
19
prvReadRole
role
20
prvReadFieldSecurityProfile
fieldsecurityprofile (gates fieldpermission reads; no standalone prvReadFieldPermission)
21
prvReadTeam
team
22
prvReadOrganization
organization
23
prvReadPosition
position
24
prvReadSolution
solution
25
prvReadUser
systemuser (named prvReadUser, not prvReadSystemUser)
26
prvReadAnyPrivilegeEntity
umbrella: configuration-entity reads with no standalone privilege
27
prvReadEntity
entity metadata
28
prvReadAttribute
attribute metadata
29
prvReadRelationship
relationship metadata
30
prvReadEntityMap
entitymap: entity-to-entity data mapping
31
prvReadAttributeMap
attributemap: column-to-column data mapping

Read-only, Organization scope, packaged in a single managed solution. The full table with scope and operation columns is in the security whitepaper, Appendix A.1.

Cryptography & network

TLS 1.2+ everywhere, with no keys we manage.

Pathix delegates all cryptographic operations to Azure platform services. Customer-Managed Keys are supported via Azure SQL and Key Vault configuration; Pathix imposes no constraints on that choice.

Encryption in transit

TLS 1.2+ on all communication. Cipher suites restricted to Azure default policy. Applies to Dataverse, Entra ID, Azure SQL, Key Vault, and any AI provider.

Encryption at rest

Azure SQL Transparent Data Encryption · Microsoft-managed keys (CMK supported). Key Vault HSMs are FIPS 140-2 Level 2 validated at the Azure platform level.

Secret storage

License key and integration secrets in Azure Key Vault. Access gated by Managed Identity and Azure RBAC. Never written to config files, env vars or logs.

Network ingress

Azure-managed TLS endpoint. Optional VNet restriction, Front Door / App Gateway with WAF, or private endpoint only, all at the Azure infrastructure layer.

OUTBOUND ENDPOINTS · NORMAL OPERATION
login.microsoftonline.com
Token acquisition · Entra ID and Managed Identity
Always
{environment}.crm.dynamics.com
Dataverse metadata reads
Always
{customer}.vault.azure.net
Secret retrieval
Always
{customer}.database.windows.net
Application database
Always
api.powerapps.com
Canvas application metadata · Power Apps Admin API
Optional
Customer-configured AI endpoint
Optional AI features
Customer-enabled
All endpoints are loggable and may be restricted by your egress policy. By default no vendor-operated endpoint is in the path: license validation is offline (a local signature check) and error reporting is customer-initiated. Online license validation for renewal hints is an optional path you can enable, governed by the same egress policy.
Application security

Hard-mode defaults, enforced in CI.

Pathix is C# (.NET 10) and TypeScript. The codebase enforces nullable reference types, treat-warnings-as-errors and TypeScript strict mode across every project, with security-relevant analyzers in the CI gate.

VULNERABILITY CLASS
MITIGATION
SQL injection
Parameterized queries via Entity Framework Core and Dapper. No dynamic SQL construction.
Cross-site scripting (XSS)
React JSX escaping by default. Content Security Policy headers. dangerouslySetInnerHTML is forbidden by lint rule.
CSRF
SameSite cookies. Bearer-token authentication on API endpoints.
Insecure deserialization
System.Text.Json with allow-list typing. No BinaryFormatter usage.
Server-side request forgery
Outbound HTTP restricted to a compile-time allow-list of endpoints.
Authentication bypass
All API endpoints require valid Entra ID bearer tokens, validated against Microsoft public keys.
Sensitive data exposure
Metadata-only boundary. Structured logging filters reject record-data fields. Stack traces sanitized before emission.
Artificial intelligence

Optional, bring-your-own-key, with AI edges labelled.

AI can extend coverage by surfacing writers and readers that static parsing alone cannot resolve, for example custom code paths, dynamic field references and external integrations. Every dependency surfaced this way carries an AI-derived confidence level so reviewers can tell at a glance which edges came from deterministic analysis and which came from a model.

BYOK by default

AI features require a customer-configured provider, Azure OpenAI, OpenAI or Anthropic. The vendor never proxies, brokers or stores AI provider credentials.

Graceful degradation

Deterministic analysis runs at full fidelity without AI. With AI enabled, the platform also surfaces AI-derived writers and readers that static parsing alone cannot resolve.

AI-derived confidence

Any writer or reader sourced from an AI sweep is tagged with an AI-derived confidence level in the trace, so reviewers can separate model-derived edges from deterministic ones.

Telemetry & privacy

Three telemetry categories in one catalog, generated from source.

In 1.0, Pathix transmits no telemetry by default: license validation is offline by default, error reporting is customer-initiated, and usage telemetry is not yet collected. The posture below covers three categories, each governed by a distinct policy. The complete catalog of every event Pathix is capable of emitting is generated from source code, so the documentation cannot drift from implementation.

WHAT IS COLLECTED
License validation
Mandatory

Validated locally by a cryptographic signature check with no network call by default. Optional online validation, for renewal hints only, sends a minimal entitlement payload (license token, tenant identifier, version, timestamp) and no usage, customer, or findings data.

Anonymous usage telemetry
Not in 1.0 · planned

Not collected in Pathix 1.0. Planned post-1.0 as opt-in mandatory: feature identifiers, scan durations, bucketed counts, error classes. Never names or record data.

Crash diagnostics
1.0 · customer-initiated

The customer generates a local log export and emails it to support; nothing is transmitted automatically. An opt-in, default-off sanitized flow is planned post-1.0.

NEVER COLLECTED, EVEN HASHEDExcluded by source-level filter
  • Plugin code, JavaScript, and code from external repos
  • Customer or tenant identifiers beyond the license identifier
  • Customer record data of any kind
  • Finding contents (the existence may be counted in aggregate; the contents are never transmitted)
Compliance mapping

The metadata-only boundary narrows the frameworks that apply to Pathix itself.

Compliance posture is determined principally by two factors: the metadata-only boundary and customer-hosted deployment. These two architectural commitments dramatically narrow the regulatory scope of the platform itself, while preserving your ability to satisfy regulatory requirements in your broader environment.

FRAMEWORK
PATHIX POSTURE
SOC 2 Type II
No production hosting infrastructure. Customer Azure subscription provides the SOC 2 control environment.
ISO/IEC 27001:2022
Customer Azure subscription provides ISMS scope.
FedRAMP / Azure Government
There is no vendor cloud to authorize. Pathix deploys into your own Azure subscription, Azure Government included, so the authorization boundary is your tenant's rather than a separate FedRAMP dependency to inherit. License validation is offline and error reporting is customer-initiated, with no phone-home, so Pathix can run in an air-gapped or restricted-network enclave; if AI is enabled it binds to a provider inside your boundary, such as Azure OpenAI Service in Azure Government. Azure Government, GCC High, and DoD impact-level targets are scoped per engagement.
NIST SP 800-53
Pathix inherits your control baseline rather than asserting its own. Running inside your subscription with no vendor production infrastructure, the relevant control families (access control, audit and accountability, system and communications protection) are satisfied by your authorized environment; the read-only, metadata-only boundary limits what Pathix adds to that scope.
GDPR
Pathix holds no business record content, so GDPR data-subject rights against record content do not attach to Pathix. Pathix does store administrative principal identifiers (display names, UPNs), which is personal data, in the customer's own tenant; the customer remains the controller. Pathix-the-vendor receives no personal data.
HIPAA
Pathix does not process PHI. A Business Associate Agreement is not required because Pathix-the-vendor does not receive customer data; Pathix runs in the customer's tenant.
PCI-DSS v4.0
Pathix does not process cardholder data. Out of CDE scope by architecture.
Shared responsibility

Customer-hosted means the boundary moves.

Because Pathix is customer-hosted, the responsibility model differs from a typical SaaS engagement. The matrix below clarifies the division.

DOMAIN
VENDOR
CUSTOMER
Application code
Security patches and releases
publish
deploy
Azure subscription and billing
Network configuration
Database backup and DR
Azure-native
Identity and access management
Entra ID
Dataverse environment hygiene
AI provider relationship and billing
BYOK
License compliance
issue
operate
End-user training
docs
delivery
Incident response in customer tenant
Disclosure & continuity

A small front door for big questions.

Vulnerability disclosure

Suspected vulnerabilities reach security@pathix.app. Reports are acknowledged within two business days and triaged within five. Critical findings ship patched releases within fifteen calendar days of validated discovery.

security@pathix.app
Supply chain

New runtime dependencies require explicit approval. The full set is enumerated in source-controlled package manifests with automated vulnerability scanning. A complete CycloneDX SBOM is generated for every release and is available on request, typically as part of an evaluation.

CycloneDX SBOM · available on request
Incident response

Pathix runs in your subscription, so incidents are first your incident under your IR procedures. The vendor coordinates on disclosure-attributable findings: validation, software remediation, and cross-customer notification when relevant.

Customer-controlled · vendor-supported

Walk an InfoSec review through the architecture.

Bring your security questionnaire. We will answer it against the actual code paths and the Bicep template.

Book security walkthroughRead the whitepaper (PDF)
Pathix

Forensics for Dynamics 365 and the Dataverse.

See it on sample data →
USE CASES
PRODUCT
COMPANY
© 2026 Pathix · self-hosted · metadata-onlyNot affiliated with Microsoft. Dynamics 365, Dataverse, and Power Platform are trademarks of Microsoft Corporation.