Security & Trust
Built so your security teams can say “yes”
The Power Platform ToolBox desktop app—the Electron-based client makers install on Windows, macOS, and Linux—ships with a pragmatic, transparent security posture so information security reviewers can quickly evaluate risk, understand data flows, and approve usage inside their organization. This site (pptb-web) only hosts the tool catalog, documentation, and community pages; the controls below describe the downloadable application itself.
Architecture in plain language
PPTB is a cross-platform Electron desktop application that installs community-built tools from an npm-based registry and runs them locally within an isolated, VS Code Extension Host-inspired “Secure Tool Host.” No customer Dataverse data is routed through PPTB-operated infrastructure—connections, credentials, and tokens stay on the user's device, and administrators retain full control over environments.
- Data storage
- Connection details, settings, and auth tokens are kept locally on the device. Supabase is used only to serve the public tool catalog/registry metadata—never customer Dataverse data.
- Authentication
- Uses Microsoft Entra ID (Azure AD) OAuth flows via the official
@azure/msal-nodelibrary to sign in and connect to Dataverse/Power Platform environments. - Distribution
- Installers are code-signed (Azure Trusted Signing on Windows, Apple notarization on macOS) and published as GitHub Releases, so organizations can verify and mirror packages internally.
Security controls at a glance
- ✅ Secure Tool Host: Each installed tool runs in an isolated, VS Code Extension Host-inspired process so one tool cannot read or interfere with another.
- ✅ Per-tool Content Security Policy: Tools must declare and request explicit user consent before reaching external resources beyond their sandboxed baseline.
- ✅ Signed & notarized releases: Windows binaries are signed with Azure Trusted Signing and macOS builds are notarized by Apple before publication—unsigned artifacts never reach end users.
- ✅ Hardened deep links: The
pptb://protocol handler validates and rate-limits install requests and always requires explicit user confirmation before installing a tool. - ✅ Transparent code: The entire desktop app is open-source (GPL-3.0) so internal security teams can audit, fork, or build custom policies.
- ✅ Continuous scanning: CodeQL static analysis runs against every change, and a Snyk project monitors every repository across the PowerPlatformToolBox organization for vulnerable open-source dependencies and license issues.
- ✅ Controlled auto-updates:
electron-updaterkeeps installations current, with user visibility and control over when updates apply. - ✅ Optional telemetry: Error tracking via Sentry is on by default to help diagnose issues, and can be disabled at any time in application settings.
For security reviewers
Artifacts we provide
- • Software bill of materials (SBOM) for the desktop app
- • Threat model outline with data-flow diagrams
- • Secure coding checklist aligned to OWASP
- • Release notes documenting security fixes
What we ask from you
- • Download installers only from official GitHub releases
- • Verify code-signing/notarization before distribution
- • Keep auto-updates enabled or patch on a regular cadence
- • Share findings so we can harden the platform
Review the desktop app source and release history atPowerPlatformToolBox/desktop-app, download signed installers from thereleases page, or browse our existing security artifacts atartifacts/security.
Need deeper details?
We partner with enterprise security, compliance, and procurement teams through our sponsorship program. White-glove service provides detailed responses to security questions and questionnaire completion for sponsoring organizations.
White-glove service includes:
- • Responses to up to 5 security-related questions or questionnaire items
- • Additional question blocks available ($200 per 5 questions)
Response time varies based on the information requested.