Security and trust

Installing software into the Windows sign-in path deserves scrutiny. Here’s how Dynacop earns trust.

Code signing

All Dynacop Windows artifacts — the setup bundle, the agent and updater installers, the agent service, and the credential-provider DLL — are Authenticode-signed with SHA-256 and timestamped. Windows shows the verified publisher:

Verified publisher: Forty2 LLC

Agent–cloud communication

All traffic is HTTPS to the Dynacop cloud; the agent makes outbound connections only (no inbound port is opened).
Every agent request is signed (HMAC) with a per-machine secret created at registration and protected on the machine with Windows DPAPI. Timestamps in the signature prevent replay (which is why a badly skewed clock causes rejections — see troubleshooting).
Security decisions that must survive an outage — Shield blocking, offline verification, recovery codes — are made locally on the machine.

Authentication factors

Dynacop uses standard TOTP: people enroll in Google Authenticator, Microsoft Authenticator, Authy, or any compatible app. There is no proprietary authenticator to install, and enrollment happens only through a verified one-time link.

Data handling

GeoIP is resolved on Dynacop’s servers (self-hosted database) — IP addresses are not sent to any third-party geolocation service, and resolved locations are not stored with the IP.
Emails never contain raw attacker IPs; reports aggregate to country level.
The public statistics feed masks IPs and rounds coordinates; workspace, resource, and person names never appear in it.
Sensitive machines can be excluded from all API output with a per-resource switch (API export opt-out).

Uninstall safety

Uninstalling removes the service, credential provider, local state, and any firewall rules Dynacop created. Deliberate offboarding can never lock users out — see retiring and removing a machine.