Security & Data Isolation¶

Your Data, Your Environment¶

Every customer gets a fully isolated set of resources — dedicated storage, dedicated key vaults, and dedicated compute. There is no shared database or shared storage between customers. Your Business Central data never co-mingles with another customer's data.

How Isolation Works¶

┌──────────────────────────────────────────────────────────┐
│  Customer Environment (isolated per customer)             │
│                                                          │
│  ┌─────────────┐  ┌──────────────┐  ┌────────────────┐  │
│  │  Dedicated   │  │  Dedicated   │  │  Dedicated     │  │
│  │  Storage     │  │  Key Vault   │  │  Compute       │  │
│  │  Account     │  │  (Secrets)   │  │  (Extraction)  │  │
│  └─────────────┘  └──────────────┘  └────────────────┘  │
└──────────────────────────────────────────────────────────┘
                              │
                              ▼
┌──────────────────────────────────────────────────────────┐
│  Your Power BI Tenant                                     │
│                                                          │
│  ┌─────────────┐  ┌──────────────────────────────────┐  │
│  │  Semantic    │  │  Reports — accessible to your    │  │
│  │  Model       │  │  users via standard Power BI     │  │
│  │  (refreshed  │  │  sharing and workspace roles     │  │
│  │  daily)      │  │                                  │  │
│  └─────────────┘  └──────────────────────────────────┘  │
└──────────────────────────────────────────────────────────┘

Resource Separation¶

Component	Isolation Level
Data storage	Dedicated storage account per customer — no shared data layer
Secrets & credentials	Dedicated key vault per customer — API keys and tokens stored separately
Compute	Dedicated extraction and transformation services per customer
Power BI	Semantic models and reports deployed to your Power BI workspace in your tenant
Access control	Service principal consented by your admin — you control who accesses the workspace

Power BI in Your Tenant¶

The semantic model and all reports are deployed directly to your organization's Power BI workspace:

Your tenant — The Power BI workspace is created in your Microsoft 365 tenant, not ours
Your access control — You manage who can view, edit, and share reports using standard Power BI workspace roles
Your Fabric capacity — Semantic model refresh runs on your Fabric capacity
Automated refresh — A service principal (consented by your admin) handles scheduled refresh — no manual uploads or file transfers

Data Flow Summary¶

Extract — Business Central data is extracted via standard APIs into your dedicated storage
Transform — Data is modeled into analytics-ready structures within your isolated environment
Load — The semantic model in your Power BI workspace is refreshed with the latest data
Access — Your users access reports through standard Power BI sharing — no additional tools or portals

Frequently Asked Questions¶

Where is my data stored? In a dedicated storage account provisioned exclusively for your organization. No other customer has access to it.

Can Elbek & Vejrup see my data? Administrative access is limited to the Elbek & Vejrup operations team for support and maintenance. All access is audited.

What happens if I stop using the service? Your Power BI workspace and reports remain in your tenant. The data storage can be decommissioned or transferred upon request.

Is the service principal safe? The service principal is created and consented through your organization's standard admin consent flow. It has permissions only to refresh the semantic model in the designated workspace — no broader access to your tenant.