Encryption in transit
Connections to supported Dynamics 365, WeChat and WeCom endpoints use HTTPS/TLS. Customer-hosted middleware requires TLS 1.2 or later.
Security & Data Protection
Secure connections.
Secure connections.
Your data, your control.
Our WeChat and WeCom Connectors are designed to connect Tencent communication channels with Microsoft Dynamics 365 while minimising data retained in the integration layer, protecting API communications and supporting customer-controlled data governance.
Applies to 
WeChat Connector 
WeCom Connector
WeChat Connector WeCom ConnectorSecurity by designProtection across the integration flow
- Customer business records stored in the customer's Dynamics 365 / Dataverse environment
- HTTPS/TLS for supported platform communications
- Token-based API authentication and least-privilege access
- Transient processing of connector messages and events
Security outcomes also depend on deployment configuration, customer policies and third-party platform controls.
Customer-controlled records
Long-term connector business data resides in the customer's Dataverse environment.
Protected communications
Authenticated API connections and HTTPS/TLS transport.
Shared responsibility
Clear ownership across Crimson, the customer and platform providers.
How the integration works
A focused integration layer — not another customer data repository.
Messages and events are validated and processed by connector middleware, then the relevant records are written to the customer's Dynamics 365 environment. The middleware is not designed to retain customer conversations as a separate long-term business database.
01 Source platform
WeChat / WeCom
Tencent platforms provide customer messages, events and authorised API access under their respective platform controls.
02 Integration layer
Crimson Connector Middleware
Validates callbacks, transforms payloads and securely forwards required records without permanent conversation storage.
03 Business system
Dynamics 365 / Dataverse
The customer's environment stores synchronised business records, supports permissions and retention, and can provide audit capabilities.
Illustrative inbound flow. Outbound integrations may call authorised Tencent APIs directly from Dynamics 365. Exact processing paths depend on the enabled connector features and deployment design.
Our security approach
Built around practical security controls.
The connector architecture uses established Microsoft and Tencent integration mechanisms, with controls aimed at protecting communications, limiting access and reducing the exposure of customer data.
Secure API authentication
Microsoft Entra ID OAuth 2.0 client credentials are used for Dataverse integration, alongside Tencent access tokens and application secrets for authorised API calls.
Least-privilege permissions
Dedicated Dataverse application users can be assigned connector-specific security roles, reducing the permissions granted to integration identities.
Webhook verification
Incoming callbacks are checked using configured verification tokens, signatures and IP controls where supported by the relevant Tencent interface.
Limited middleware retention
Message and customer interaction payloads are processed transiently. Short-lived tokens, technical caches and necessary diagnostic information may be used to operate the integration.
Audit and operational visibility
Customers can use Dataverse security, auditing and retention capabilities. Integration logs support troubleshooting and should exclude unnecessary personal data and secrets.
Data handling & residency
Know where your data goes and who controls it.
Our connectors are designed to avoid unnecessary duplication of customer information. Microsoft Dataverse is the long-term system of record for synchronised connector data, while Tencent continues to operate the underlying WeChat and WeCom platforms.
Your business records stay in your environment.
Depending on the features enabled, customer Dataverse records may include WeChat followers, WeCom contacts, conversations, interaction history, messages and service records.
- Customer controls Dataverse user access and security roles
- Customer manages business-data retention and auditing policies
- Data location follows the customer's Microsoft tenant and environment configuration
- Microsoft platform encryption protects data at rest, subject to the customer's configuration
Purpose-limited integration processing.
The middleware receives, validates, transforms and routes the information needed to deliver configured connector functions. It is not intended as an independent archive of customer messages.
- Message content is not persistently stored as middleware business records
- Access tokens and certain configuration values may be cached temporarily
- Integration credentials are protected using encryption mechanisms
- Hosting arrangements and infrastructure controls are agreed for each deployment
Cross-border and regional considerations. Tencent platform data is handled within Tencent's infrastructure, while synchronised records are stored in the customer's chosen Dynamics 365 environment. Where these locations differ, the customer should assess applicable data-transfer rules, lawful bases, notices and contractual requirements. Customer-controlled middleware deployment can be discussed where supported.
Shared responsibility
Security works best with clear ownership.
The precise split depends on whether the middleware is customer-hosted or provided under an agreed hosting arrangement. The responsibilities below describe the typical operating model.
Crimson Dynamics
- Connector application and integration design
- Installation and configuration guidance
- Product-level maintenance and troubleshooting
- Technical guidance for application permissions and secure operation
Customer organisation
- Microsoft tenant, accounts and Dataverse access
- Data retention, auditing and privacy notices
- Customer-hosted server, network, patching and certificate management where applicable
- Required consents, lawful use and regional compliance decisions
Platform providers
- Microsoft: Dynamics 365 and Dataverse platform controls
- Tencent: WeChat / WeCom services, APIs and platform rules
- Cloud host: infrastructure security according to the selected hosting model
- Service availability and controls within each provider's own scope
Security & privacy FAQs
Answers to common security questions.
For a formal vendor assessment, architecture review or customer-specific data flow, request the relevant technical documentation from our team.
Does Crimson store customer conversations in a separate database?
The connector middleware is designed for transient processing and does not maintain a separate long-term repository of customer conversation content. Synchronised business records are written to the customer's Dataverse environment. Limited technical caches and operational logs may still be used to run and support the integration.
Where are customer messages and contact details stored?
Records synchronised into Dynamics 365 are stored in the customer's Dataverse environment, subject to its location, permissions and retention settings. WeChat and WeCom platform data also remains subject to Tencent's platform storage and processing arrangements. Middleware hosting location depends on the agreed deployment.
How are integration credentials protected?
The connectors use Microsoft Entra ID OAuth 2.0 application credentials and Tencent API tokens/secrets as applicable. Credentials are protected using encryption mechanisms; access tokens can be cached for operational purposes and refreshed according to platform requirements. Customers should rotate credentials under their security policies.
Can we control who sees synchronised information?
Yes. Customers can use Dynamics 365 and Dataverse security roles, business units and other Microsoft platform controls to restrict access to relevant records. A dedicated connector application user should have only the privileges needed for the integration.
Is WeCom private-message archiving automatic?
No. Synchronising private WeCom conversations requires the applicable Tencent message archiving service/subscription, appropriate configuration and a suitable legal basis, notices or consent where required. The customer is responsible for deciding which communications should be collected and how long they are retained.
Does using the connector automatically establish regulatory compliance?
No technology alone guarantees compliance. The architecture can support privacy and security requirements, but obligations depend on the customer's jurisdiction, deployment, data flows, policies and contracts. Assessments under laws such as China's PIPL or the GDPR must be performed for the specific use case.
Need a detailed security review?
Discuss hosting options, architecture, data processing, access control and customer-specific security requirements with our team.
This page provides a general description of connector security design and is not a security certification, independent audit report or guarantee of regulatory compliance. Actual controls depend on deployed versions, configuration, customer environment and contract scope.
