Zentriq for Business Central

Two products, separately installable. PunchOut: Chrome extension + BC mini app, captures e-commerce carts as Requisition Worksheet lines. Agent: BC extension, in-product AI chat. SaaS, multi-tenant, GDPR + Swiss nFADP compliant.

1 · Architecture — PunchOut (Chrome → BC direct)

┌──────────────┐               ┌──────────────┐
│  User in     │ ────HTTPS───▶ │  E-commerce  │
│  Chrome      │               │  site DOM    │
└──────┬───────┘               └──────────────┘
       │ cart data stays in browser
       │
       ├── HTTPS ──▶ Zentriq backend (EU) — credit check & debit only
       │              (no cart contents)
       │
       └── HTTPS ──▶ Your BC tenant — OAuth2 PKCE, user's own token
                     (Requisition Worksheet lines inserted directly)

2 · Architecture — Agent (BC → Zentriq → Anthropic)

┌──────────────┐  HTTPS  ┌──────────────────┐
│  BC user     │ ──────▶ │ Zentriq backend  │
│  (browser)   │         │ (Vercel EU)      │
└──────────────┘         └────────┬─────────┘
                                  │
                  ┌───────────────┼──────────────┐
                  ▼               ▼              ▼
          ┌──────────────┐ ┌─────────────┐ ┌──────────────┐
          │ Anthropic    │ │ BC API      │ │ Neon         │
          │ Claude (US)  │ │ (your       │ │ Postgres EU  │
          │ ZERO RETAIN  │ │  tenant)    │ │ (encrypted)  │
          └──────────────┘ └─────────────┘ └──────────────┘

3 · What Zentriq Accesses

4 · Encryption (both products)

5 · Microsoft Entra ID — permissions requested

• openid / profile / email — sign-in
• Dynamics 365 Business Central API — Financials.ReadWrite.All — read / write BC data on the user's behalf, scoped by their BC permission set
• offline_access — refresh token (Agent only; PunchOut uses short-lived access tokens directly from Chrome)

Your BC permissions are the ultimate gate — Zentriq cannot exceed what the user's own BC account is allowed to do. The PunchOut BC permission set (Zentriq Punchout) is least-privilege by design: read Item / Vendor / Req. Wksh. Name; insert Requisition Line. Nothing more.