Entra Integrated Health
Security & data handling.
Application inventory, detailed reports and scan history are processed and stored on your Windows server. Online features have specific data requirements, described below so your team can make informed decisions.
Reviewed release: 0.2.36 · Last reviewed: October 21, 2026
Security maintenance: version 0.2.36
Version 0.2.36 updates the application certificate trust bundle to certifi 2026.10.19, addressing GHSA-6q48-6c7w-9gw2. The hosted billing service has also been patched. The pinned app and billing dependency sets returned no known advisories in the October 21 patch scan; this does not cover every operating-system or runtime component.
Existing users: open Settings → Software updates, check for updates and install 0.2.36 or later. Download the current upgrade package. New installations receive the patched dependency in the full installer.
What stays with your installation
Discovery reads application and directory information from your Microsoft Entra tenant through Microsoft Graph. The resulting application inventory, owners, permissions, credential-expiration metadata and detailed reports are held locally.
The installed dashboard is served on the server’s loopback address. Reviewed report pages use local or embedded resources. Local scan history and backup files remain in your installation’s data directories unless your own backup, synchronization or export processes move them elsewhere.
What online features process
These features process customer-related information outside your server. Aggregate counts and operational status can still be sensitive, so choose approved services and recipients.
| Feature | Information involved | Where it goes / your control |
|---|---|---|
| Microsoft authentication and discovery | Tenant and application identifiers, certificate-based authentication assertions and directory requests. The private collector key stays on the server. | Microsoft identity services and Microsoft Graph, using your configured registration and permissions. |
| Online licensing | Tenant ID, activation credentials, device-credential hashes, administrator object ID and license/subscription state. | Veritas Next’s licensing service hosted on Render. Used for activation, trial eligibility and renewal. |
| Billing | Tenant ID in customer/subscription metadata, plan selection and billing identifiers. You enter payment information in Stripe-hosted checkout. | Stripe and the publisher billing service. You choose when to purchase or manage a subscription. |
| Optional usage sharing | Allowed feature-category counts and a generated batch ID, linked to your licensed tenant through authentication. | Publisher service on Render. Off by default; turning it off clears unsent counts. It is tenant-linked aggregate usage. |
| Report email | Sender/recipient addresses, scan timestamp, discovery status and aggregate summary counts. The reviewed summary excludes detailed inventory and report attachments. | Your configured Microsoft Graph or TLS SMTP service and selected recipients. Disabled until configured/enabled. |
| Support cases | The contact email, subject, case text, category and app version you submit, linked to your tenant. Files and diagnostic logs are not attached automatically. | Publisher support service on Render; replies may use the publisher’s Microsoft 365 mailbox. Creating a case requires consent in the app. |
| Update checks | Requests for software metadata and packages; hosting services can process connection metadata such as IP addresses. | Your configured update host. Daily checks are enabled by default and can be disabled. Update installation is user initiated. |
Credential and update protections
- Collector private keys, saved SMTP passwords and activation settings use Windows DPAPI and installer-configured filesystem restrictions.
- Microsoft Graph connections use HTTPS, reject cross-host pagination and disable HTTP redirects in the reviewed collection path.
- SMTP delivery requires TLS. Certificate-based Graph and SMTP OAuth modes use the local collector certificate.
- Software updates are verified using a pinned signing key before installation. This package verification is distinct from Windows publisher code signing.
- Local application logs accept approved events and numeric fields. Sensitive free-text errors are excluded from the reviewed normal collector logging path.
Inventory databases and local database backups are ordinary SQLite files. Use suitable server access controls, disk encryption and backup policies to protect them at rest. DPAPI credential protection does not encrypt the entire inventory database.
Storage and retention
- Local snapshot history defaults to 90 days and is configurable. Local backup retention defaults to 14 days; backup maintenance preserves a most-recent backup. Local logs have configurable age and size limits.
- Publisher installation-usage counters have 90-day retention in the reviewed code. Marketing event counters have 180-day retention. Cleanup occurs when the relevant recording or overview functions run.
- Support cases and licensing/account records have no verified automatic deletion schedule in the reviewed implementation. Contact support about a deletion request; deletion across provider backups and billing records requires separate assessment.
- Microsoft, Stripe, Render, mail recipients and other infrastructure providers may retain operational, billing, email, backup and connection records under their own settings and obligations. Their actual retention settings were not independently verified in this review.
Website analytics consent is separate from the installed app’s optional usage sharing. Loading website media and pages also involves the site’s hosting and media providers.
What we validated
Our internal review checked the Python source associated with the signed published 0.2.36 update and reviewed the publisher backend source. We verified the update manifest signature and matching archive checksum.
57 targeted automated checks passed, including privacy checks for default-disabled telemetry, allowed payload fields, support consent, summary-email exclusions, report assets, Graph destination restrictions and safe logging. The checks used synthetic data and mocked network boundaries; they also passed with socket creation blocked.
A full Windows end-to-end traffic capture, independent assessment and inspection of provider-side retention remain follow-up work. These results support the documented design and tested paths; they are not a certification or a guarantee that third parties process no customer information.
Questions about your deployment?
Email support@veritasnext.com for clarification about these data flows. Avoid sending private keys, access tokens, full reports or sensitive inventory in support messages.