Tenant Security

How We Protect Your S/4HANA Connection

When you connect a live S/4HANA tenant, security is non-negotiable. Here is exactly how Clean-Core.io handles your credentials, data, and access — with full transparency.

Read-Only Scope

No write operations — ever.

Every tenant connection is strictly limited to a connection check, read-only OData metadata requests and read-only OData GET requests, each one started by you. Running generated tests against the tenant is locked until the isolated live runner has passed its review. Clean-Core.io never writes, modifies, or deletes any data on your S/4HANA system.

What We Read

OData service metadata ($metadata endpoints)
Read-only OData responses for the entities you choose to read

What We Never Do

No POST, PUT, PATCH, or DELETE operations
No transport releases or workbench changes
No data exports or bulk reads from business tables

Recommendation: We strongly advise creating a dedicated technical communication user with minimal, read-only authorizations (e.g., S_SERVICE scope restricted to metadata endpoints) on your S/4HANA system for Clean-Core.io connections.

Secure Storage & Stateless Transit

Encrypted credentials and transient business data.

Your connection credentials are encrypted using AES-256-GCM and stored securely on Google Cloud Platform in Europe (completely blocked from direct client SDK access). All actual business data (such as transactional records or metadata lists) retrieved from your S/4HANA OData tenant is processed transiently and never persisted, cached, or logged on our servers. Uploaded code files are stored in your encrypted, user-isolated project workspace, which you can permanently delete at any time.

Credential Isolation

Credentials are decrypted only within the server-side proxy at execution time. They are never exposed to client-side APIs or browser storage.

Stateless Business Transit

The backend OData transit layer is fully stateless. No business records or transaction responses are stored after execution.

EU-Region Hosting

Hosting, the database and every call to your tenant run in the GCP europe-west1 (Belgium) region. The Gemini API and the mail provider are separate subprocessors, named with their transfer safeguards in the privacy policy.

SAP Destination service: For maximum security, we recommend importing your connection as a standard HTTP destination JSON from the SAP Destination service instead of manually entering credentials. This inherits your existing connectivity profiles on SAP BTP and OAuth configurations.

Admin Onboarding Gate

Manual review and approval for every connection request.

To prevent misuse during the Free Community Edition, every tenant connection request is manually reviewed and approved by our admin team before activation. There is no self-service provisioning — this is by design.

How the Approval Process Works

You Submit a Connection Request

After signing in, open Settings and submit a tenant connection request with a short motivation; your name and e-mail address come from your account. The system details (hostname, client, communication user) are entered only after approval.

Admin Review

Our team receives a notification and manually reviews the request. We check the requesting user account and the stated use before anything is activated.

Approval or Feedback

Once approved, your tenant connection is activated and you receive an email confirmation. If we have questions, we reach out before activation.

Active Monitoring

Connected tenants are monitored for unusual activity. Access can be revoked at any time if misuse is detected.

Why manual approval? Since this is a Free Community Edition, we want to ensure every connection is legitimate and intentional. This protects both the platform and your system from unintended exposure.

Questions about tenant security? Reach out anytime.