Security
SC4SAP security architecture
SC4SAP's safeguards are enforced in code, not in documents. This page sets out what they block, what they ask you about, and what they cannot block.
- Your SAP authorizations, and nothing moreIt operates only within the authorizations the registered SAP user already has
- Production is read-onlyIn the QA and production tiers, the create, change and delete tools are removed entirely
- Sensitive data is not extractedRow extraction from tables such as bank and payroll cannot be unlocked, even with approval
1.How your system is protected
What the AI can do is limited in layers. Each layer is designed to fail in a different way, so if one layer is missing or misconfigured, the next one still blocks.
Tools are excluded by tier
Every connection is given a development, QA or production tier. In the QA and production tiers, tools that change the system are left out of the session altogether. The AI cannot call a tool it cannot see, so even a cleverly written prompt cannot get around this. A tier cannot be changed once created; to change it, you delete the connection and create it again.
Row extraction from sensitive tables is blocked
Bank and payroll tables, and tables of a similar nature, are on a permanent block list. Content reads and SQL queries against these tables are refused before the request ever reaches the user, and no approval from anywhere can unlock them.
Sensitive calls stop and ask a person
Sensitive calls that pass the first two layers show the tool and its exact input before running, then wait. If no answer comes, the call is automatically denied when the time limit expires, and closing the browser is also treated as a denial.
The MCP server's own guard is always on
The MCP server that talks directly to SAP (abap-mcp-adt-powerup) contains the same blocks. Even if the plug-in's hooks are missing or misconfigured, this layer does not switch off.
Verified during installation
Right after connecting, the setup wizard checks the session round trip, system information and ADT authorizations, registers the row-extraction block hook and the tier block hook, and then runs a smoke test to confirm that both actually block. If this step does not pass, setup does not finish.
2.A setup that fits your network
SC4SAP connects through SAP's ADT (ABAP Development Tools) interface. You choose the connection path to match your company's security policy, and there is no need to open a path your policy forbids just for SC4SAP.
| Environment | Setup |
|---|---|
| Internal network | The plug-in runs inside Claude Code on the user's PC. That PC only needs to reach the SAP server; the SAP side is not opened to the outside. |
| Remote · external access | Use the routes your company already has in place, such as VPN, allowlists or gateways. How the route is set up follows your company's policy. |
| S/4HANA Cloud | Both the Public and Private editions can connect, as long as ADT is enabled. |
| Multiple systems · entities | One connection is one profile. Register development, QA, production and each entity's systems separately, and give each its own tier. |
| Segregated networks · on-premises installation | Conditions differ from one environment to another, so we review them with you in an adoption consultation. |
The source code and query results the AI reads to produce its answers are sent to the model provider's (Anthropic) API, so a route out to that API is required. Do not connect it to data that cannot leave your network.
3.Operational data and auditing
- SAP data
- We do not store separate copies or backups of your SAP system. Data is read only as needed, at the time of each task.
- Model training
- We do not use customer content to train models, and we do not share or sell it to anyone other than the providers needed to run the service.
- Credentials
- The plug-in keeps SAP passwords in the OS keychain (Windows Credential Manager · macOS Keychain · Linux libsecret). The web workspace stores connection details encrypted and never shows them in the browser again after they are saved.
- Audit log
- The web workspace records every prompt, skill run, approval and denial for each account, so you can check later who allowed what.
- System changes
- Changes made in a tier that allows writes are not simulations. They are recorded in SAP with the registered technical user as the author and carried in transports, so they remain in SAP's change history as is.
Your part in keeping it safe
- Connect with a dedicated technical user that has only the authorizations the work requires, not a personal administrator account. Review those authorizations regularly.
- Give every system the correct tier. SC4SAP cannot tell when a production system has been registered as development.
- Run new skills in a non-production environment first. Outputs are drafts for a reviewer and do not replace your company's review, approval and transport procedures.
- Do not approve a request without reading it.
4.Security of SC4SAP Web (PoC)
The web workspace is in the PoC / closed test stage. Below are the standards we currently apply; the setup may change before the official release.
- Served over HTTPS onlyLogin cookies are set to be sent over HTTPS only. You sign in with a Google account.
- Only the web app is exposedThe backend that runs AI sessions is not exposed publicly, and it accepts requests from the web app only after verifying their signatures.
- Connection details are stored encryptedSAP connection details and API keys are encrypted with AES-256-GCM and are never sent back to the browser.
- Concurrent sessions are limited per accountThere is a cap on the number of AI sessions a single account can open.
- Dependencies are checked for vulnerabilities before every deploymentWhen a known vulnerability turns up, we upgrade the affected version to close it before deploying.
To connect a production system during the PoC stage, we first review the setup with you in an adoption consultation.
5.What the safeguards cannot block
The safeguards are a safety net that reduces risk, not a compliance program.
- They cannot classify your data for you. They do not know which of your custom tables contain personal information.
- Values written directly into source code are part of the source, so if a program you ask it to read contains sensitive values, those values are read as they are.
- AI output can be wrong or incomplete. Applying it to important systems must remain the responsibility of a qualified person.
Need a security review?
We go through the setup for your environment and your security team's review together in an adoption consultation. Please report suspected vulnerabilities to sc4sap.dev@gmail.com.