Security and data handling
Understand credentials, access permissions, and the data sent for reporting.
Two kinds of credentials
| Credential | Where it is used | Where it is stored |
|---|---|---|
| Tenant identifier and organization API key | Authenticate Business Central requests to the HA integration server. | Business Central's NTMP Settings table. |
| Facility Id and Facility Secret | Allow the integration server to obtain facility access to NTMP. | Encrypted by the integration server using ASP.NET Core Data Protection. |
The onboarding wizard masks the facility secret and clears its credential input variables after a successful save. The extension does not persist the facility credentials in Business Central tables. Later requests identify the facility by license number.
Use the HTTPS server address supplied by HA Consultancy. The extension uses the configured URL, so do not replace it with an unsecured HTTP address.
Restrict access to settings
The organization API key is stored as a settings value and is not masked on the settings page. Assign the NTMP_FINANCIAL_HAC permission set to authorized operators only. It includes modification access to configuration, facility and sync records, job queue entries, and G/L account mappings.
If your organization needs report-only access, have your Business Central administrator provide a narrower role instead of treating this permission set as read-only.
Submission data
General ledger submissions include:
- Facility license number and submission mode.
- NTMP account number and transaction date.
- Debit and credit amounts and the facility's configured currency.
- Facility ledger identifier.
- Document reference and entry description.
Only transactions that touch mapped accounts are automatically queued. Once a transaction qualifies, all its accounts must be mapped, and its nonzero G/L entries are included.
Audit and support information
The integration server records operational information such as operation name, response status, success or failure, duration, and trace identifier. Submission audit summaries include the license, line count, and mode. Credential-save audit summaries omit the facility Id and secret.
When requesting assistance, share the sync Entry No. and error details. Keep API keys and facility secrets out of emails, screenshots, and documentation.
Policies
For questions about your hosted integration service, retention, or access arrangements, contact HA Consultancy.