Menu

Installation Security, Best Practices and Compliance

Applies to Sharperlight version 8 and later.

Sharperlight is built for organisations that need to put data in front of their people, and increasingly in front of AI tools, without giving up control of it. This article describes how Sharperlight protects your data, the standards it is designed against, and the settings we recommend when you install and operate it.

Security at a glance

  • Strong encryption of stored credentials and of data in transit
  • Sign-in with Windows, LDAP, Microsoft Entra ID or named Sharperlight accounts
  • Two-factor authentication (authenticator apps)
  • Access control by user, group, product, table, report and function
  • IP address whitelisting
  • Full auditing, with security reports in Site Setup
  • Tamper detection on user and group records, so direct database changes are caught
  • Privacy controls aligned with European data protection requirements
  • Built-in safeguards and access control for AI and MCP connections
  • Signed applications
  • Regular penetration testing, including independent and AI-assisted testing
  • Web sign-in designed against OWASP guidance

Secure results always depend on choosing the right configuration when you set up the Application Server. The checklist at the end of this article gives you a quick way to confirm it.

Technology

Sharperlight is built on Microsoft .NET (4.8 and 10), with WCF services, WPF and WinForms clients and ADO.NET data access. Communication supports TLS 1.2 and 1.3 over TCP/IP, HTTP and HTTPS. Two-factor authentication is compatible with Google Authenticator and other TOTP authenticator apps. Stored credentials and sensitive settings are protected with strong encryption.

Tamper detection. User and group records in the Sharperlight database carry integrity (CRC) checks. If someone changes a record directly in the database, bypassing Sharperlight, the check fails, the record is refused and the event is logged. An administrator then has to review and unlock the account in Site Setup.

Accounts and sign-in

Windows and LDAP accounts. Passwords stay with your directory and are never stored by Sharperlight.

Microsoft Entra ID. Users sign in with their organisation account (see the Entra ID section below).

Named Sharperlight accounts. You can enforce password complexity, minimum length, expiry and a forced change at next sign-in. Optional self-registration and e-mail based password reset are available, and each can be switched off.

Two-factor authentication. Users can be enrolled with an authenticator app and asked for a code at sign-in. Reports can also be protected with access codes or two-factor authentication.

Account maintenance. Manage users through Active Directory groups, synchronise them from an external database through a Datamodel, or maintain named accounts directly.

Sign-in protection. Repeated failed sign-ins lock the name for a short period, and the lock is recorded in the audit log.

Web sign-in sessions

The Web Channel sign-in is designed against OWASP guidance for session management:

  • A “Remember me” sign-in never stores your password or a reusable credential in the browser. The browser holds only a random value in a secure, HttpOnly cookie that scripts cannot read.
  • The server keeps only a hash of that value, so a copy of the database cannot be used to sign in.
  • The value is replaced each time it is used (rotation), and a copy of an old value is detected, refused and logged.
  • Sign-ins have an absolute expiry set by an administrator (Client Setup, Remember Me Expiry Days, default 90 days). Changing a password, disabling a user, signing out or an administrator choosing Force re-sign-in ends them at once.
  • Sign-in pages are never cached.

Microsoft Entra ID integration

Sharperlight integrates with Microsoft Entra ID (formerly Azure Active Directory) so that people use the account they already have, and your existing identity controls continue to apply.

What you get

  • Single sign-on for the Web Channel and for AI clients. Users sign in on Microsoft’s own sign-in page. Sharperlight never sees their Microsoft password.
  • Your policies apply. Multi-factor authentication, conditional access and account lifecycle rules set in Entra ID are enforced at sign-in.
  • User and group synchronisation. Users and groups can be synchronised from Entra ID, so access follows group membership and leavers lose access when their Entra account is disabled.
  • No separate password to manage. Entra users have no Sharperlight password to reset, reuse or leak.

How it works

  1. Register Sharperlight as an application in your Entra ID tenant and set its redirect addresses.
  2. In Site Setup, enter the application (client) ID, tenant ID and, if you use one, the client secret in the Entra ID user synchronisation settings.
  3. Synchronise users and groups, then assign Sharperlight rights to the synchronised groups.
  4. Users now sign in with Microsoft. Accounts that exist in your tenant but are not mapped in Site Setup, such as guest accounts, are not given access.

Connections to Entra ID and Microsoft Graph are protected end to end, and the sign-in is checked for the correct application, tenant and request before a user is admitted.

Web Channel and the service

Sharperlight supports TLS 1.2 and 1.3. For secure environments choose Windows (NTLM) or Entra ID sign-in rather than Basic authentication, and use Basic only over HTTPS.

Client Setup, Service, Security Level lets you harden the Web Channel quickly. Levels run from Low to Very Strict, and each higher level restricts more of the Web Channel’s pages and functions.

Access control

Control access by user or group for products, tables, reports and functions. Row-level security is available where the Datamodel implements it. Reports can additionally be protected by access codes or two-factor authentication. Sensitive capabilities are off until you grant them.

AI and MCP security

Sharperlight can expose your governed data to AI assistants through the Model Context Protocol (MCP). The same controls apply to AI access as to any other user:

  • Standards-based sign-in. AI clients sign in with OAuth 2.1 and PKCE, or with Microsoft Entra ID. There are no shared keys to leak.
  • Access modes. Administrators decide what an AI connection can do, from full access to data-only and public read-only modes.
  • Your rights, not more. An AI client can only reach what the signed-in user is allowed to reach.
  • Strong built-in safeguards. Limits on usage and result size, restricted tools for lower access modes, and generic error messages protect your environment from misuse.
  • Full auditing. Every AI request is logged against the user, and the MCP audit log is available in Site Setup.

Privacy and European regulations

Sharperlight helps you meet European data protection requirements, including the GDPR, by letting you limit the personal data it keeps.

  • Redaction in MCP logging. For AI and MCP activity, user details, IP addresses and query parameters can be redacted from the log, so you keep an audit trail of what happened without keeping personal data or the content of requests.
  • Your own retention period. You choose how many days MCP log entries are kept, so personal data is not held longer than your policy allows.

Sharperlight does not need your users’ passwords for directory and Entra ID accounts, and sign-in credentials are never kept in the browser.

Auditing and vulnerability reporting

Sharperlight records credential changes, sign-ins, locked names, rejected sign-in attempts, optional report access and service events. Start-ups, shut-downs and errors are also written to the Windows Event Log. Site Setup includes a series of security reports that help you find and review vulnerabilities and risk in your own installation. Right-click Users in Site Setup and choose Report:

  • Security Audit Log
  • Users – Mapped User
  • Users – Permissions
  • User Groups – Mapped User
  • User Groups – Permissions
  • Model Context Protocol (MCP) – Security Audit Log

The Users tree also helps at a glance: users are highlighted in different colours when their password needs attention, for example when it is blank or expiring, so weak accounts are easy to find.

Application signing

The application, its DLLs and the Excel add-ins are digitally signed, so tampering can be detected.

Penetration testing and AI-assisted security review

Security is tested continuously, not once a year.

  • Independent testing. Sharperlight has also been through independent security testing.
  • AI-assisted testing and hardening. Alongside independent testing, we run extensive AI-assisted penetration-style testing against the Web Channel, the SOAP and REST services and the MCP service. Each finding is recorded, rated and followed up, and fixes are re-tested.
  • Hardening in every release. Findings from both kinds of testing feed directly into the product, for example in sign-in sessions, access control and AI connections.

Designed against OWASP guidance

Sharperlight’s web sign-in and session handling is designed against OWASP guidance, including the OWASP Top 10 and the Application Security Verification Standard for session management and authentication. Examples in version 8:

  • Cookies are HttpOnly, Secure and SameSite, and carry no credentials.
  • Remember-me values are random, stored only as hashes, rotated on use and reuse is detected.
  • Sessions expire on an absolute schedule that an administrator controls.
  • Passwords can be forced to meet complexity, length and expiry rules, and repeated failures are throttled and audited.

Hardening checklist

  1. Serve the Web Channel and service over HTTPS.
  2. Choose Windows or Entra ID sign-in where you can. Use Basic authentication only over HTTPS.
  3. In Client Setup, Service, raise the Security Level to suit the exposure of the service.
  4. Turn on two-factor authentication for named accounts, especially on the internet.
  5. Set Remember Me Expiry Days to what your policy allows.
  6. Disable features you do not use: self-registration, password reset, user creation and deletion in the Web Channel.
  7. Password-protect remote Site Setup connections, and protect your administrator accounts.
  8. Use IP whitelisting where it applies.
  9. Review the Site Setup security reports and audit logs regularly.
  10. Restrict firewall ports and have clients use remote connections only.

Recommendations by environment

Intranet. Use Windows or Entra ID accounts. Use HTTPS for the Web Channel and service as well, because internal networks are no longer a safe assumption. Password-protect remote connections.

Internet. Use HTTPS only. Enforce password complexity for named accounts, require two-factor authentication, password-protect remote connections, restrict firewall ports and have clients use remote connections only.

Related Posts

Privacy Preference Center

Consent Management

It is Sharperlight’s policy to respect your privacy regarding any information we may collect while operating our website. Accordingly, we have developed this privacy policy in order for you to understand how we collect, use, communicate, disclose and otherwise make use of personal information.


Sharperlight Terms of Service and Privacy Policy

1. Terms

By accessing the website at http://www.sharperlight.com/, you are agreeing to be bound by these terms of service, all applicable laws and regulations, and agree that you are responsible for compliance with any applicable local laws. If you do not agree with any of these terms, you are prohibited from using or accessing this site. The materials contained in this website are protected by applicable copyright and trademark law.

2. Use License



Permission is granted to temporarily download one copy of the materials (information or software) on Sharperlight's website for personal, non-commercial transitory viewing only. This is the grant of a license, not a transfer of title, and under this license you may not:


modify or copy the materials;
use the materials for any commercial purpose, or for any public display (commercial or non-commercial);
attempt to decompile or reverse engineer any software contained on Sharperlight's website;
remove any copyright or other proprietary notations from the materials; or
transfer the materials to another person or "mirror" the materials on any other server.


This license shall automatically terminate if you violate any of these restrictions and may be terminated by Sharperlight at any time. Upon terminating your viewing of these materials or upon the termination of this license, you must destroy any downloaded materials in your possession whether in electronic or printed format.


3. Disclaimer


The materials on Sharperlight's website are provided on an 'as is' basis. Sharperlight makes no warranties, expressed or implied, and hereby disclaims and negates all other warranties including, without limitation, implied warranties or conditions of merchantability, fitness for a particular purpose, or non-infringement of intellectual property or other violation of rights.
Further, Sharperlight does not warrant or make any representations concerning the accuracy, likely results, or reliability of the use of the materials on its website or otherwise relating to such materials or on any sites linked to this site.


4. Limitations

In no event shall Sharperlight or its suppliers be liable for any damages (including, without limitation, damages for loss of data or profit, or due to business interruption) arising out of the use or inability to use the materials on Sharperlight's website, even if Sharperlight or a Sharperlight authorized representative has been notified orally or in writing of the possibility of such damage. Because some jurisdictions do not allow limitations on implied warranties, or limitations of liability for consequential or incidental damages, these limitations may not apply to you.

5. Accuracy of materials

The materials appearing on Sharperlight's website could include technical, typographical, or photographic errors. Sharperlight does not warrant that any of the materials on its website are accurate, complete or current. Sharperlight may make changes to the materials contained on its website at any time without notice. However Sharperlight does not make any commitment to update the materials.

6. Links

Sharperlight has not reviewed all of the sites linked to its website and is not responsible for the contents of any such linked site. The inclusion of any link does not imply endorsement by Sharperlight of the site. Use of any such linked website is at the user's own risk.

7. Modifications

Sharperlight may revise these terms of service for its website at any time without notice. By using this website you are agreeing to be bound by the then current version of these terms of service.

8. Governing Law

These terms and conditions are governed by and construed in accordance with the laws of Australia and you irrevocably submit to the exclusive jurisdiction of the courts in that State or location.

Privacy Policy

Your privacy is important to us.

It is Sharperlight's policy to respect your privacy regarding any information we may collect while operating our website. Accordingly, we have developed this privacy policy in order for you to understand how we collect, use, communicate, disclose and otherwise make use of personal information. We have outlined our privacy policy below.


We will collect personal information by lawful and fair means and, where appropriate, with the knowledge or consent of the individual concerned.
Before or at the time of collecting personal information, we will identify the purposes for which information is being collected.
We will collect and use personal information solely for fulfilling those purposes specified by us and for other ancillary purposes, unless we obtain the consent of the individual concerned or as required by law.
Personal data should be relevant to the purposes for which it is to be used, and, to the extent necessary for those purposes, should be accurate, complete, and up-to-date.
We will protect personal information by using reasonable security safeguards against loss or theft, as well as unauthorized access, disclosure, copying, use or modification.
We will make readily available to customers information about our policies and practices relating to the management of personal information.
We will only retain personal information for as long as necessary for the fulfilment of those purposes.


We are committed to conducting our business in accordance with these principles in order to ensure that the confidentiality of personal information is protected and maintained. Sharperlight may change this privacy policy from time to time at Sharperlight's sole discretion.