Security and data residency

Where the work happens

VerseDocs is a managed Dataverse solution: a plug-in package registered as Custom APIs (vdocs_*), a model-driven admin app, two custom tables (templates and usage counts) and a command-bar button. There is no VerseBlocks web service in the generation path, no Azure resource in your subscription, no Entra app registration and no connector to consent to.

When a user clicks Generate document, or a flow calls an action, Dataverse executes the plug-in in its isolated sandbox worker in the same region as your environment. The plug-in reads the template row and the target record under the calling user's privileges, renders the document in memory, and hands the bytes back to the caller or attaches them as a note on the record. The sandbox has the same network and execution restrictions Microsoft applies to every registered plug-in.

PDF conversion runs in the same sandbox, using a commercially licensed .NET rendering library embedded in the plug-in package. VerseDocs does not use OneDrive, SharePoint, Microsoft Graph or a hosted converter to produce PDFs, and it never writes an intermediate file anywhere.

What moves, and where

Every input and output is a Custom API parameter. Templates arrive as base64 from the template table or from your flow; data arrives as JSON or is resolved from the record; the result leaves as base64. Nothing is written to blob storage, a queue, a log or a temporary file by VerseDocs.

The only three things that can leave

Three Custom APIs can transmit to VerseBlocks. None of them runs as part of generating or converting a document; each runs only when the admin app or a flow you built calls it. Telemetry never includes document content, template content, file names or field values.

• With the vdocs_TelemetryEndpoint environment variable unset, none of the three actions transmits anything at all.
• Purchasing is a Stripe Checkout session opened from the Licensing page in your browser; card details go to Stripe, not to VerseBlocks or the plug-in.

Licensing without a phone-home

A licence key is a single signed string bound to your tenant. The plug-in verifies the signature with an embedded public key on every call; it never contacts a licensing service to decide whether a document may be generated, so nothing stops working because a service was unreachable. A key issued for another tenant is rejected as belonging to a different tenant rather than silently working.

The licensing service is contacted only from the Licensing page in the admin app, when you buy or retrieve a key. An unlicensed environment is a full-function trial: every action works, generated documents carry a visible trial watermark, and the optional utility-pack actions return a licence-required error. When a paid year ends, the watermark returns; nothing is deleted and no template or flow breaks.

Identity and access

Plug-ins execute under the calling user's Dataverse identity. A user can only generate a document from a record they can read, with related rows they can read, using a template they can read. Flows run as their connection's user or service account, with that account's privileges and time zone.

VerseDocs ships three security roles: User (read the template catalogue, generate), Template Author (create and edit templates, use Template Studio) and Administrator (licensing and configuration). Without one of them the Generate document button's template picker is empty. The button itself is off on every table until an administrator enables that table, so it never appears where it was not asked for.

Data residency and retention

Because rendering happens in the Dataverse sandbox of your environment, generated documents are processed in the same Azure region as that environment and inherit your tenant's data-residency commitments. VerseBlocks has no copy of any template, record or document, and therefore nothing to delete, retain or disclose on your behalf.

Generated files persist only where you put them: a timeline note, a SharePoint library, an email attachment, a Dataverse file column. Retention is governed by your own policies on those locations. The vdocs_usage table holds per-call counts (action, duration, input and output sizes, edition) and no content; you may truncate it at any time.

Provenance and auditability

Every document produced from a record is stamped with custom document properties recording the template id, name and version, the generating user's id, the UTC timestamp and the VerseDocs version (or the equivalent PDF Info keys for PDF output). Anyone with the file can see which template produced it and when. Set includeProvenance to false in Options to suppress stamping for a call.

Errors are named codes (TEMPLATE_FIELD_MISSING, FETCHXML_INVALID, EDITION_REQUIRED and so on) with messages that identify the token or query at fault, never a silently blank field. A misspelt column stops generation rather than producing a document that looks right and is not.

About the vendor

VerseBlocks LLC is an independent software vendor. The product is designed so that no customer document, template or record is ever processed on VerseBlocks systems; the controls that apply to your documents are the ones already governing your Microsoft tenant. VerseBlocks does not claim third-party certifications for its own systems, and does not need access to your environment to support you. Questions for a security review go to admin@verseblocks.com and are answered in writing.