Verifiable security, privacy by default
Scope: VietLicenSure v5.0 Desktop, LAN server/Agent, Central Dashboard, License Compliance, and local reports. Effective 2 October 2026; updated 4 October 2026.
1. Principles
Local-first
Inventory and reports are processed on the endpoint or an organisation-managed LAN server.
Data minimisation
Only signals needed for technical assessment, reporting and status monitoring are processed.
Transparency
Online mode is opt-in; technical activation remains separate from ownership evidence.
Least privilege
The app starts as a standard user and requests elevation only for an authorised privileged task.
2. Data flows
| Scope | Data processed | Destination |
|---|---|---|
| Offline desktop | Windows/Office technical state, installed software, hashes and evidence summaries. | Local endpoint only. |
| Online switch | Signed software-identification catalog, then the signed application-version manifest. | Public data is validated locally; no inventory upload, scan, report, or automatic version download/install. |
| Separate online actions | Assistant knowledge, only when the user deliberately selects that action. | Public data is downloaded; no local inventory is uploaded. |
| LAN/Agent | Device name, internal IP, last seen, technical channel/state and alerts. | Managed LAN server. |
| Central Dashboard | Allow-listed API fields required for display. | LAN browser with a short-lived, IP-bound session. |
| Reports | Policy-redacted report data. | User-selected local file. |
3. Data not intentionally collected or exposed
- No cloud telemetry or inventory upload by default.
- No full product keys, passwords, pairing secrets or ClientId in the Dashboard.
- No full PowerShell or Event Log history in reports.
- No third-party CDN, remote font or tracker on this documentation site.
4. Storage, access and deletion
Configuration, reports and server data remain on the endpoint or LAN server until an authorised user or administrator removes them. Local secrets use appropriate Windows protection; Dashboard sessions are short-lived, IP-bound and expire after 30 minutes. Each organisation controls its own retention, folder permissions and backup policy.
5. Software policies
Enterprise software governance
Inventory and classification as Freeware, Open Source, Commercial, Subscription, or Unknown are technical signals. The organisation remains responsible for approved installation sources, evidence and Purchased / Assigned / Installed reconciliation.
License Advisor provides Rule IDs, evidence sources, confidence, and Explain this finding; KMS or a single indicator doesn't independently prove cracking or unlawful entitlement. System changes still require preview, confirmation, backup and post-checks.
Controlled partial source
A selected set of non-core modules is disclosed for independent inspection as proprietary source-available material. It is not open-source, and core source and reuse rights remain controlled.
6. Security controls
- Offline by default; the user-triggered Online switch refreshes the signed catalog then checks application-version availability without auto-install.
- Assistant knowledge is downloaded only through a separate user-started action.
- Downloaded catalogs, manifests, provenance and knowledge are checked using signatures, hashes and a pinned signer.
- The Dashboard and allow-listed API are read-only and cannot control endpoints.
- System changes use a dry run, confirmation, backup, and post-checks.
- Reports redact serials, UUIDs, paths and contextual identifiers.
7. Enterprise responsibilities
Organisations should restrict subnets/firewall rules, control authorised administrators, retain entitlement evidence, define report retention and review alerts. Activated/Licensed is a technical signal and does not replace invoices, contracts or licensing portals.
8. Trust status and compliance boundary
This policy does not constitute ISO 27001, SOC 2 or GDPR certification, a DPA, an SLA, or legal advice. Each enterprise must assess its own legal and internal-control requirements.
9. Security reporting and contact
Submit vulnerabilities privately through GitHub Private Security Advisory. Use GitHub Issues for non-sensitive defects and thanhvietit.hopnghia@gmail.com for general support.