Business Central Reporting: Live Query or Data Copy?

By Thomas Werkhoven, CEO of Exsion365, registered accountant, previously group controller and CFO.

Halfway through a reporting tool evaluation, someone from IT asks the question finance had not thought about: where does this thing keep our data? It is a fair question, it changes the contract you are about to sign, and almost no vendor page answers it directly.

The short answer

Business Central reporting tools use one of three architectures. The first copies your Business Central data on a schedule into a database the vendor operates, and you report on the copy. The second queries Business Central live as the signed in user and keeps nothing in between, so the only copy is the workbook you save. The third mixes the two, reading live for some things and from a stored model for others.

None of these is wrong. What matters is that you know which one you are buying and can answer three questions about it: where does the copy live, who secures it, and under which terms. If the tool keeps no copy, all three questions disappear, which is a smaller compliance surface rather than a longer feature list.

Everything below is the evidence, in each vendor's own wording, checked in September 2026. At the end we answer our own checklist, including the question where our answer is no.

What cloud reporting for Business Central usually means

Take Cosmos as the worked example, because its documentation is unusually clear about the mechanism.

You install a Business Central extension. Cosmos's installation article says the extension enables Cosmos to extract data from Business Central and bring it into the Cosmos reporting database, and that the steps should be completed by a Business Central user who has administrative or Extension Management permissions within Business Central (Cosmos support). The tables you choose are managed in what Cosmos calls the Staging Area, described as a single place to select the tables and fields that should be brought into Cosmos from your data source(s), and for a source such as Business Central data from the data source is also incrementally loaded into the Staging Area when the pipelines are run (Overview of the Staging Area). Loading is therefore a scheduled job rather than a query: if you ask for a full reload and do not run it by hand, the full load will be run during the next scheduled data refresh (How to Manually Run a Full Load).

On the product side, Cosmos states that everything resides on Microsoft Azure and that each Cosmos customer has their own environment (tenant) and database, so your data is never accessible by anyone else, with report level security, row-level security controls to protect information at the data level and security at the folder level all configured inside Cosmos (features/cloud). The pricing page lists Azure Storage and Consumption inside the 500 dollar monthly base fee alongside the Business Central cloud data connection and one full user, which indicates the database runs in Cosmos's own Azure subscription rather than in yours (pricing). Cosmos describes the result as all the benefits of a traditional data warehouse (without the expensive price tag) (features/reporting). Its tenant setup article documents the tenant being created on first portal login, with no region choice and no subscription choice anywhere in the flow (Creating Your Cosmos Tenant).

Put plainly: your general ledger gets a second home, on a schedule, in infrastructure the vendor runs. That is the architecture. Now the trade-off, in both directions.

What the copy buys you

A warehouse copy is a real engineering choice with real benefits, and a comparison that skips them is not worth reading.

Reporting off a copy means your reports never load the Business Central tenant, however many people run them at once and however wide the query is. It also means you can join Business Central data to things that are not in Business Central, which is exactly what Cosmos sells as add-ons: unlimited Excel data file connections, Azure SQL databases and a Dataverse connector, each up to 10GB, at 150 dollars per month (pricing).

A stable stored model is what Power BI wants, so a warehouse makes a Power BI layer straightforward rather than a project, and Cosmos lists two way Power BI integration and more than 30 prebuilt reports on top of it. Scheduled distribution is easier too: because the data is already staged, Cosmos can run reports on a date, time and frequency you set and email them out or drop them in SharePoint without anyone opening Excel (features/reporting). And for a group where Business Central is one of several systems finance reports on, a warehouse is arguably the correct answer rather than a compromise.

Cosmos is US based, sells into the UK through an exclusive reseller and has limited presence elsewhere in Europe, so for a US buyer with a US tenant several of the questions in the next section are quieter. They are not quiet for a Dutch or German group.

What the copy costs you

Two things, and neither is a defect. They are consequences.

The second security model

Business Central already has a record level security model, and it is more precise than most people realise. Microsoft's documentation is direct about it: For record-level security in Business Central, you use security filters to limit a user's access to data in a table. You create security filters on table data. A security filter describes a set of records in a table that a user has permission to access. The example Microsoft gives is a user who can only read the records that contain information about a particular customer, and the enforcement is not cosmetic, because security filters are handled by SQL Server just like other filters (Microsoft Learn: using security filters).

Apply a security filter to G/L Entry, table 17, narrowing a user to one Global Dimension value, and the restriction lives with the table rather than with a page. That is the governance layer you already own and already maintain, on top of the company level rights every Business Central administrator sets anyway.

When a tool copies the data out, that enforcement does not travel with it. The copy has no concept of your permission sets, so access control has to be rebuilt in the new place. Cosmos is straightforward about where that happens: report level, row level and folder level security are configured inside Cosmos (features/cloud). Velixo puts the consequence more sharply on its own comparison page, and it should be read as a competitor's view rather than as neutral fact: it describes Cosmos as a traditional cloud data warehouse (ETL/ELT) platform that extracts your data, moves it to a separate cloud storage layer, and requires you to manually run reports on staged, asynchronous data, and says Cosmos requires your IT department to manually replicate and continuously manage your ERP security rules inside Cosmos (velixo.com).

The practical test is simple. When a controller changes role next month and you narrow their rights in Business Central, does the reporting tool follow automatically, or does someone have to remember to change it in a second place? A model maintained in two places drifts, and the drift stays invisible until an audit or a leaver finds it.

The questions the public pages do not answer

Here is where a European evaluation stalls. Reviewing Cosmos's product, support, security and pricing pages in September 2026, we could not find published answers to any of the following: the Azure region the customer database sits in, whether it can be hosted in the customer's own subscription instead, the data retention and deletion policy, a data processing agreement or GDPR page, or a statement of who owns the stored data. Cosmos does not publish these, which is not the same as saying they do not exist or that the answers are unfavourable. It means you have to ask, get the answer in writing, and attach it to the contract rather than to a sales call.

Cosmos's own security post addresses the cloud in general terms, citing Azure's 200+ physical data centers and industry standard encryption, without stating the customer's region, ownership or deletion terms (Busting Cloud Security Myths, published January 2024). On compliance, Cosmos announced completion of a SOC 2 Type 1 examination on 24 June 2026, and says in the same post that it is continuing through the next stage of the SOC 2 process, during which auditors will evaluate the operation of its documented controls over time. That is the Type 2 work, and it is worth crediting rather than glossing over.

The distinction between the two is worth carrying into any vendor conversation, whichever vendor it is: a Type 1 report assesses whether controls are suitably designed at a point in time, while a Type 2 report tests whether those controls operated effectively over a period, commonly six to twelve months. Both sit in the AICPA's SOC suite of services. For the avoidance of any doubt about who is arguing what here, we hold neither report ourselves, and we explain why at the end of this article.

The live query route

The alternative is to keep the data where it already is. Exsion Reporting is an Excel add-in that connects directly to Business Central through its OData web services, so a controller pulls live data from any Business Central table into Excel, refreshes with one click and reuses the report. Exsion stores no data of its own. There is no staging area to load, no pipeline schedule to watch and no second database, so the only copy of your ledger data is the workbook the user saves, which sits under your own Microsoft 365 controls like every other finance file. Microsoft's OData web services reference documents the interface.

The security consequence is the useful part. The permissions are the ones you already set in Business Central, because the query runs as the signed in user. If a user has rights to only one company, that is the only company they see in Excel. If their permission set carries a security filter on a table, that filter applies to the Exsion query exactly as it applies in the client, so the G/L Entry case above behaves the same way in a workbook as it does on a page. Nobody configures a matching rule in a second product, and nobody has to remember to update one.

Consolidation follows the same principle. Exsion Corporate handles group reporting, including eliminations such as intercompany, at the consolidation level, and those eliminations can be booked in a separate Business Central company so the operating companies stay unchanged and the group numbers are not assembled on a separate platform. Our guide to consolidating multiple companies in Business Central walks through what that looks like in Excel.

Exsion is Dutch, based in Gouda and Zoetermeer, and sells into Dutch, German and English speaking markets, which is the reason these questions are answerable at all: they get asked at every European kickoff. We have a data processing agreement and will send it before signature.

Where Jet Reports sits

Jet Reports, renamed in 2026 to insightsoftware Reporting for Business Central in the Business Central extension list and now shipping under the Lineos brand, is an Excel add-in that reads Business Central through the web services its extension publishes, function by function, with Jet Hub handling scheduling and distribution. insightsoftware's own product page describes the model as live: Connect live to your Dynamics ERP and build refreshable reports in Excel, and Connect directly to your Dynamics environment and work with live data in Excel (insightsoftware.com). On the question this article asks, then, the standard Jet Reports setup sits on the live query side rather than the copy side.

One caveat, and it is a portfolio caveat rather than a criticism. insightsoftware sells a wide range of reporting and analytics products, and a quote can contain more than the Excel add-in. Whether a particular deployment also stores data somewhere depends on which components the customer bought, so ask for the answer per component rather than per vendor. Our fuller profile of the product sits in the Jet Reports alternative for Business Central guide, and the wider market, including Cosmos and Velixo, is covered in our roundup of Business Central Excel reporting tools.

Side by side: where your data lives

The six criteria that decide the architecture question, per vendor, from the sources cited above.

[[TABLE_START]]

Criterion | Cosmos | Jet Reports / insightsoftware | Exsion Reporting

Where the reporting data sits | Cosmos reporting database on Azure, one environment and database per customer, tables selected and loaded through a Staging Area | In Business Central for the Excel add-in, read through the web services the extension publishes; other products in the portfolio may differ, so ask per component | In Business Central. Exsion stores no data; the only copy is the workbook the user saves

Refresh model | Scheduled incremental pipeline runs; an unrun full load happens at the next scheduled refresh | Live at report run time, one request per function | Live query on refresh, one click

Security model | Report, row and folder level security configured inside Cosmos | Business Central permissions through the published web services | Business Central permissions, applied because the query runs as the user: company rights and table security filters both carry through

Region choice | Not published; tenant is created on first portal login with no region or subscription selection | Data stays in your Business Central tenant for the add-in, so your Microsoft region applies | Data stays in your Business Central tenant, so your Microsoft region applies

Published compliance statements | SOC 2 Type 1, 24 June 2026, with the next stage of the SOC 2 process under way; retention, deletion, DPA and ownership not published | Enterprise vendor compliance programme, not reviewed for this article | Data processing agreement available on request; no SOC 2 Type 1 or Type 2 report

Pricing transparency | Published: 500 dollars per month base including Azure storage and one full user, 150 dollars per add-on, 50 and 15 dollars per extra user; no free trial stated | Quote based, no public pricing | Published pricing page, 30 day trial from AppSource

[[TABLE_END]]

How to decide

Choose the copy when you genuinely need what it buys. If finance reports across Business Central plus other systems, if Power BI models are central to how the business consumes numbers, if scheduled distribution to people who never open Excel is a daily requirement, or if query load on the production tenant is a live problem, a warehouse earns its place and the extra governance work is a fair price.

Choose the live query when none of that applies. If the reporting job is Business Central data in Excel for controllers, the copy is optional, and optional copies of a general ledger are worth avoiding. Every copy adds a location to document, a retention question to answer, an access model to keep in step and a processor to name in your records. If your group reports in more than one country, the region question alone can outlast the tool evaluation.

And be honest about the third case: if you are buying the copy for governance reasons, check the logic. Governance is enforceable in Business Central today, at the record level, on the tables that matter. A copy does not create governance. It creates a second place where governance has to be configured and maintained.

Five questions to put in the evaluation

Paste these into the email and ask for written answers.

1. Does the product store our Business Central data outside our tenant? If yes, in which Azure region, in whose subscription, and can we choose?

2. How is access controlled on the stored copy, and does it follow our Business Central permissions automatically when they change?

3. What is the retention and deletion policy, and what happens to the stored data within how many days of termination?

4. Will you sign a data processing agreement naming sub-processors, and can we see it before signature?

5. Which SOC 2 report do you hold, Type 1 or Type 2, and what period does it cover?

If a vendor answers all five in writing, the copy is a design choice you can live with. If the answers are hard to get, that is itself the answer.

Our own answers to those five questions

It would be poor form to publish a checklist without answering it, so here is Exsion on the record.

We store none of your data. The add-in connects directly to Business Central through OData web services, so there is no region and no subscription to discuss, because there is no second database. Access control is whatever you have already configured in Business Central, applied because the query runs as the signed in user, which is why a user with rights to one company sees only that company in Excel and a security filter on a table narrows the query the same way it narrows a page. Retention and deletion do not apply to us for the same reason, and the workbook a user saves stays inside your own Microsoft 365 environment under your own retention rules. We have a data processing agreement and will provide it before signature.

On the fifth question our answer is no. Exsion holds neither a SOC 2 Type 1 nor a Type 2 report. We think the honest framing is this: a SOC 2 report is an assurance about a service organisation's controls over the data it holds, and we hold none of your reporting data, so the risk that report is designed to address does not arise in the same way. That is an argument, not a certificate, and if your policy requires a SOC 2 report from every supplier regardless of architecture, you should weigh that openly rather than let us talk you out of it. Ask us the question anyway. A vendor who answers the uncomfortable one in writing is telling you something useful about the other four.

For the Business Central side of this, Microsoft's page on using security filters is the one to bookmark, and our guide to live Business Central data in Excel with no warehouse walks through what the live query setup actually looks like.

Frequently asked questions

[[FAQ_START]]

Does Cosmos store my Business Central data? | Yes, by design. Cosmos's own documentation describes a Business Central extension that extracts data into the Cosmos reporting database, with the tables you select loaded incrementally into a Staging Area when the pipelines run. Cosmos does not publish the Azure region, an option to host in your own subscription, or a retention and deletion policy, so ask for those in writing.

Is a reporting copy of Business Central data a GDPR problem? | Not automatically. It is a processing arrangement you have to document. If a vendor stores your ledger data, that vendor is a processor, and you need a data processing agreement, a named location, a retention period and a deletion commitment. A tool that stores nothing removes the arrangement rather than solving it.

What is the difference between SOC 2 Type 1 and Type 2? | A Type 1 report assesses whether a service organisation's controls are suitably designed at a single point in time. A Type 2 report tests whether those controls operated effectively over a period, commonly six to twelve months. Cosmos completed a Type 1 examination in June 2026 and says the next stage is under way. Exsion holds neither report, because Exsion stores none of your reporting data.

Does Exsion store Business Central data? | No. Exsion Reporting connects directly to Business Central through OData web services and stores no data of its own, so the reporting data stays in your Business Central tenant and the only copy is the workbook a user saves in your own Microsoft 365 environment.

Does Exsion use my Business Central permissions? | Yes. The query runs as the signed in user, so the rights you already set in Business Central apply without a second security model. A user with rights to only one company sees only that company in Excel, and a security filter set on a table narrows an Exsion query exactly as it narrows a page in the client.

Can I choose the Azure region my reporting data sits in? | With a live query tool the question does not arise, because the data stays in your Business Central tenant and your Microsoft region applies. With a vendor hosted warehouse it depends entirely on that vendor. Cosmos does not publish a region choice, and its tenant setup documentation describes a tenant created on first portal login without a region or subscription selection.

[[FAQ_END]]