Security & Privacy

A detailed explanation of how DVDAddin handles your data — data flow, encryption, third-party services.

Data flow overview

┌─────────────────┐
│ Excel workbook  │ (local, on your machine)
└────────┬────────┘
         │
         ↓ (only the data you actively translate / ask AI about / send)
┌─────────────────────────────────────────────┐
│ DVDAddin (runs locally)                     │
├─────────────────────────────────────────────┤
│ • 47 calculation UDFs, all local            │ ← NO network access
│ • Translate (Google / Gemini / ChatGPT…)    │ ← Network
│ • AI Chat, OCR, Extract Table, Audio→text   │ ← Network
│ • DVD Chat (team messaging)                 │ ← Network
│ • Connect (LAN or MQTT)                     │ ← Network (when enabled)
│ • License heartbeat (every 30 minutes)      │ ← Network (JWT + machineId only)
│ • Check Update (when you click it)          │ ← Network (version only)
└─────────────────────────────────────────────┘
         │
         ↓ HTTPS
┌─────────────────────────────────────────────────────────────┐
│  Third-party services (only when you choose to use them)    │
├─────────────────────────────────────────────────────────────┤
│ • translate.google.com/m         (Translate — Google)       │
│ • generativelanguage.googleapis.com (Gemini)                │
│ • api.openai.com                 (ChatGPT, if configured)   │
│ • api.groq.com                   (Groq, if configured)      │
│ • integrate.api.nvidia.com       (NVIDIA NIM, if configured)│
│ • *.firebasedatabase.app         (DVD Chat)                 │
│ • open.er-api.com / api.frankfurter.app (DVDFx function)    │
│ • PriceBoard.vcbs.com.vn         (dvdStock function)        │
└─────────────────────────────────────────────────────────────┘
         │
         ↓
┌─────────────────────────────────────────────────────────────┐
│  Cloudflare Worker — dvdaddin-license-server…workers.dev    │
├─────────────────────────────────────────────────────────────┤
│ • Login / heartbeat / anchoring the Trial start date        │
│ • Orders + price list (buying a license)                    │
│ • Update feed (/api/update/latest)                          │
│ • Does NOT receive workbook content                         │
└─────────────────────────────────────────────────────────────┘

Data types and destinations

Data type	Leaves your machine?	Where to?
Workbook content (cell values in general)	NO	—
File names / paths	NO	—
Results of the 47 calculation UDFs	NO	—
Text you choose to translate	Yes	Google / Gemini / OpenAI / Groq / NVIDIA
Your question + the cell range attached in AI Chat	Yes	The AI provider currently selected
Images / PDFs you run OCR or Extract Table on	Yes	Gemini (default) or OpenAI / Groq / NVIDIA
Audio files you transcribe to text	Yes	OpenAI or Groq (endpoint /audio/transcriptions)
Messages + files in DVD Chat	Yes	Firebase Realtime DB + Firebase Storage (asia-southeast1)
Cells and formatting while Connect is on	Yes	The host machine on the LAN, or the MQTT broker you configure
License login email + password	Only when you log in	Cloudflare Worker
Machine ID (SHA-256 hash, 16 characters)	Yes, with every license call	Cloudflare Worker
Windows machine name + OS version	Yes, when the Trial is anchored / at login	Cloudflare Worker
Add-in version	When you click Check Update	Cloudflare Worker

Read the "machine name" row carefully

DVDAddin does send the Windows machine name (Environment.MachineName) and the operating-system version string to the license server, inside the trial-anchoring and login payloads. This is trial anti-abuse data, but it is not "nothing at all is sent" — if your machine name contains sensitive information (a person's name, a project code), be aware of that.

How the Machine ID is computed

MachineId = SHA-256( MachineGuid | MachineName | OSVersion )  → take the first 16 hex characters

MachineGuid is read from HKLM\SOFTWARE\Microsoft\Cryptography (64-bit view). The three components are mixed together so that two machines cloned from the same image still produce different IDs.

A consequence worth knowing: renaming the Windows machine or upgrading the Windows version changes the Machine ID — the license treats it as a new machine and may ask you to log in again.

Encryption layers

1. Network — HTTPS

Every outbound call goes over HTTPS, using the standard Windows/.NET 8 TLS stack (TLS 1.2/1.3 by default). The add-in does not do certificate pinning: it trusts the Windows root certificate store, so a corporate content-inspection proxy (with its own root CA installed) can still decrypt the traffic.

2. License file (HMAC-SHA256)

%LocalAppData%\DVDAddin\license.dat is stored as JSON + HMAC-SHA256 with a key embedded in the DLL.

The HMAC here is not a security mechanism — the server is the authority; it only blocks hand-editing of the cache file.

When that folder is not writable (ACL, Controlled Folder Access), the add-in falls back to storing it in HKCU\Software\DVD\DVDAddin\Licensing\LicenseBlob.

3. JWT signature (RS256)

The license token is a JWT signed with RS256:

• The server holds the private key (a Cloudflare Worker secret).
• The client holds the RSA-2048 public key (embedded in the DLL).
• Every time the license is loaded, the client verifies the signature itself — a token that fails is treated as forged and discarded.

The JWT lifetime is 7 days, plus about 1 day of client-side cache buffer. That means the add-in runs in full offline for about 8 days at most from the last online check.

4. Per-install signing salt (HKDF)

At each login the client generates (or reuses) a random 32-byte salt for that machine.

Every request to the license/purchase endpoints is signed with two extra headers:

X-DVDA-Ts:  <unix seconds>
X-DVDA-Sig: HMAC-SHA256(METHOD + "\n" + PATH + "\n" + sha256(body) + "\n" + TS, key)

where key = HKDF(rootKey, machineId, salt). A request replayed more than 5 minutes later is rejected by the server on clock skew; a curl/Postman call without those headers gets a 403.

5. Clock-rollback anchor

HKCU\Software\DVD\DVDAddin\Licensing\MaxSeenUtc records the highest timestamp the add-in has ever seen. A machine clock set back too far behind that mark is treated as time tampering to extend the trial/license.

Third-party API privacy

Google Translate (free, no key required)

• Endpoint: https://translate.google.com/m?hl=… — the add-in reads the mobile translation page and scrapes the result; it does not use a contracted API.
• Consequence: there is no data-processing agreement between you and Google for this path.
• Recommendation: do NOT use it for sensitive data (unit rates, salaries, unsigned contract terms).

Google Gemini

• Endpoint: generativelanguage.googleapis.com.
• API key: you obtain it yourself from Google AI Studio and enter it into the add-in yourself — the key is yours and does not pass through the DVDAddin server.
• Privacy: under the Gemini API terms, content on the free tier may be used to improve the service; on the paid tier it is not.

OpenAI / Groq / NVIDIA NIM

• Endpoint: api.openai.com/v1/chat/completions, api.groq.com/openai/v1/chat/completions, integrate.api.nvidia.com/v1/chat/completions.
• All three use your own key. API-tier policies usually do not use data for training — read the terms of the provider you pick yourself, because policies change over time.
• NVIDIA NIM replaced the former Cerebras provider from 2026-06; an old configuration that says "Cerebras" is mapped to NVIDIA automatically by the add-in.

DVD Chat (Firebase)

DVD Chat is a team chat channel running on Firebase Realtime Database + Firebase Storage located in the asia-southeast1 region. The messages and files you send in the chat sit on Google infrastructure, not on your machine. Do not paste passwords, tender rates or confidential data into it.

Connect (teamwork)

Connect has two paths and does not go through the DVDAddin server:

• LAN — one machine on the network runs the server on a port (8888 by default) and the others connect by IP. The data never leaves the internal network. Packets are encrypted with the Data password that the whole team types in.
• Internet (MQTT) — points by default at the public broker broker.hivemq.com. This is shared infrastructure: anyone who knows the room ID can get in. For real project data, run your own broker and pick a room ID that is hard to guess, and set a strong Data password as well.

Cloudflare Worker (license)

• Address: dvdaddin-license-server.dangvandangdvd.workers.dev.
• Location: runs on the Cloudflare edge network, usually the data centre nearest to you.
• Data stored: email, edition, expiry date, hashed machine ID, signing salt, machine name. No workbook content.
• Account/data deletion requests: email [email protected].

What DVDAddin does NOT send

Not sent:

• Workbook content (except exactly the part you choose to translate, ask AI about, OCR, chat or sync with the team).
• File names, folder paths, sheet lists.
• Browsing history, the list of installed applications, data from other software.
• The results of the 47 calculation UDFs — except the four that must go out to the network by their very nature: dvdTranslate, dvdAIExplain, DVDFx, dvdStock.

Sent (stated above, repeated for clarity): the hashed machine ID, the Windows machine name, the operating-system version, the add-in version, the login email.

Audit: checking network traffic

Wireshark

1. Install Wireshark and capture on the network adapter in use.
2. Set the display filter tls.handshake.type == 1 to see only new TLS sessions, then read the Server Name (SNI) column — this is how you see the destination without decrypting anything.
3. Open Excel, run the commands one by one and watch the SNI values appear.

The list of legitimate domains you may see:

• dvdaddin-license-server.dangvandangdvd.workers.dev — license, orders, update feed.
• translate.google.com — when translating with Google.
• generativelanguage.googleapis.com — Gemini (translation, AI, OCR, Extract Table).
• api.openai.com, api.groq.com, integrate.api.nvidia.com — when you select that provider.
• *.firebasedatabase.app, firebasestorage.googleapis.com, identitytoolkit.googleapis.com, securetoken.googleapis.com — DVD Chat.
• open.er-api.com, api.frankfurter.app, cdn.jsdelivr.net — the DVDFx function.
• priceboard.vcbs.com.vn or quotes.vcbs.com.vn — the dvdStock function.
• github.com / objects.githubusercontent.com — when downloading the installer.

The add-in also opens your browser at a few addresses when you click a link in the interface — that traffic belongs to the browser, not to Excel: dvdaddin.dvdpm.net plus youtube.com, zalo.me, github.com (the About window); aistudio.google.com, platform.openai.com, console.groq.com, build.nvidia.com (the "get an API key" buttons in Preferences).

Seeing a domain outside these two lists while you are only using DVDAddin is worth questioning.

Fiddler / mitmproxy

To see the request bodies as well, you need an HTTPS-decrypting proxy (install the tool's root certificate). Because the add-in does not pin certificates, this approach works. You can verify:

• That the payload sent to the AI provider is exactly the text you selected, with no other cells attached.
• That the payload sent to the Worker contains only machineId, machine name and email — no spreadsheet data.

Compliance

Vietnam

• Personal data is stored at the bare minimum: email, machine name, hashed machine ID, license details.
• You have the right to request access to or deletion of your account via [email protected].
• If your data must not leave the internal network: use Connect in LAN mode and avoid the AI / translation / chat commands.

GDPR (EU)

DVDAddin does not target the EU market yet and has no formal DPA / right-to-be-forgotten process. Organisations with GDPR obligations should carry out their own assessment before rolling it out.

HIPAA (US healthcare)

DVDAddin makes no claim of HIPAA compliance. Do not use it for medical records.

Security best practices

1. Keep secrets out of every AI command

Everything you select before clicking Translate, AI Chat, OCR or Extract Table is sent verbatim to the AI provider. Before running a command on a sheet, look at the selection again — translating the whole "Internal notes" column has happened to plenty of people.

2. Check the SHA-256 of the installer

The add-in's update feed can carry a sha256 field for the download package. Check it before installing:

Get-FileHash .\DVDAddin.rar -Algorithm SHA256

Only download the installer from the link opened by the Check Update or Download Tool command, never from a re-shared source.

3. Whitelist DVDAddin in your antivirus

Some AV products occasionally quarantine the .xll file. Add an exclusion for the C:\DVDAddin\ folder.

The caveat in the other direction: keeping the antivirus on also pays off — Outlook only drops the "a program is trying to access e-mail" warning when Windows Security reports the machine as protected.

4. Protect your API keys

The API keys sit in HKCU\Software\DVD\DVDAddin\API Keys\ (GeminiAPI, ChatGPTAPI, GroqAPI, NvidiaAPI) as plain text, unencrypted. Anyone who can reach your Windows profile can read them.

• Shared machine: log out of Windows when you leave it, and do not share a Windows account.
• Suspect a leak: revoke the key in the provider's console, then enter a new one in Preferences → the AI Assistant section.

5. Back up license.dat before reinstalling Windows

→ See Backup & restore.

6. Be careful with Connect's MQTT mode

The default broker is public infrastructure. Set your own room ID and a strong Data password, and disconnect when the session is over with the Disconnect command.

Reporting a security vulnerability

If you find a vulnerability:

• Email [email protected] with a subject starting with [SECURITY], describing it with reproduction steps.
• Do not publish exploit details before a fix is available.

Related

• License — details of the license system and how to activate it.
• Preferences — where you enter the API keys (AI Assistant section).
• Connect — LAN and MQTT, two different risk models.
• DVD Chat — team chat running on Firebase.
• Backup & restore.
• FAQ — Security & privacy.