Before production use:
• Change, deactivate, or delete all default Basic accounts
• Use a trusted production certificate and HTTPS
• Restrict Windows Firewall to required clients and ports
• Run the service under a dedicated, least-privilege account
• Restrict SQL Server and file-share permissions to that account and administrators
• Deny direct end-user access to the object store and data-protection keys
• Use UNC paths instead of mapped drives
• Verify that project folders cannot feed output files back into an input folder
• Select only required barcode types, OCR languages, and Microsoft Graph permissions
• Protect backups containing the database, object store, keys, and license state
• Review log access and retention
• Test recovery and license reactivation procedures
The public “Integrations API” applies audit logging, IP-based rate limiting, security headers, and production HTTPS enforcement. General endpoints are limited to 60 requests per minute per IP; upload paths are limited to 10 requests per minute per IP. Rate-limit excess returns HTTP 429. The default upload limit is 100 MB.