Security and Trust

Certifications and compliance

365TUNE’s controls are independently audited for SOC 2 Type II, and its security management is certified to ISO 27001.

• SOC 2 Type IIIndependent audit report
• ISO 27001Certified
• GDPRData protection addendum with SCCs

For our SOC 2 Type II report, ISO 27001 certificate or a security questionnaire, email trust@365tune.com.

How 365TUNE connects to Microsoft 365

Infrastructure security

How the systems that run 365TUNE are protected. Each control is monitored in our trust center.

• Unique sign-in everywhere Every person signs in to systems, applications, the production network and production databases with their own account or an authorized SSH key.
• Production access on a business need Access to the production application, network and databases is limited to authorized staff who need it.
• MFA for remote access Production systems can be reached remotely only by authorized staff with multi-factor authentication.
• Encrypted remote access Remote access to production uses an approved encrypted connection.
• Access removed when people leave A termination checklist removes a leaver’s access within set timeframes.
• Intrusion detection An intrusion detection system monitors the network continuously for signs of a breach.
• Log management A log management tool flags events that could affect security, and system activity logs are kept for at least six months.
• Network segmentation The network is segmented to keep unauthorized users away from customer data.
• Firewalls Firewalls block unauthorized access, and their rules are reviewed at least once a year.
• Patched infrastructure Servers are patched in routine maintenance and whenever a vulnerability is found.

Organizational security

How 365TUNE manages its people and devices.

• Production inventory A formal inventory of production systems is maintained.
• Anti-malware Anti-malware runs on systems at risk of attack, with routine updates and logging.
• Managed devices Devices that support the service are managed centrally with mobile device management.
• Password policy Passwords for in-scope systems follow the company’s password policy.
• Yearly performance reviews Managers review each direct report at least once a year.

Product security

How your data is handled inside 365TUNE.

• Encryption at rest and in transit Datastores holding customer data are encrypted at rest with AES-256, and data moves over TLS.
• Customer data kept apart Each customer’s data is logically separated from every other customer’s data.
• Vulnerability scanning External-facing systems are scanned at least every quarter, and critical and high findings are tracked until fixed.
• Control self-assessments Controls are assessed at least once a year, and findings are corrected within any committed timeframe.

Internal security procedures

How security is governed, assessed and communicated.

• Yearly risk assessment Threats and changes to our commitments, including the risk of fraud, are assessed at least once a year.
• Board oversight The board is briefed on cybersecurity and privacy risk at least once a year, has a documented charter, includes independent directors and brings in outside security experts when needed.
• Cybersecurity insurance Insurance covers the financial impact of a business disruption.
• Vendor agreements Vendors and other third parties sign written agreements with confidentiality and privacy commitments.
• Commitments in writing Security commitments to customers are set out in the Terms of Service and the data protection addendum.
• Change notices Customers are told about critical system changes that may affect their data, and staff are told about system changes.
• Support for customers Customers can report failures, incidents and concerns through an external support system, and have guides and technical support.
• Documented organization An organization chart sets out structure and reporting lines, and the service is described to staff and customers.

Where your data lives

Your data is processed and stored in the United States by default. Processing in another region, such as the European Union, can be agreed in your contract. Transfers out of the EEA, the UK and Switzerland use the Standard Contractual Clauses.

365TUNE uses these sub-processors:

We tell customers before adding or replacing a sub-processor, so you can object. When your contract ends, you choose whether we delete your data or return it.

AI and your data

• Your data, prompts and answers are never used to train an AI model.
• 365TUNE doesn’t store your prompts or the answers. Enterprise customers can also turn on zero data retention at the AI service.
• AI processing runs in the United States by default, and in the EU on request.
• The AI agent can suggest a change, but nothing happens without your consent and an approval.
• You can turn the AI agent off for your tenant.

Incidents and availability

If a security incident affects your personal data, we tell you without undue delay and no later than 72 hours after we confirm it, and we help you investigate and respond.

The SLA sets a 99.9% monthly availability target, and scheduled maintenance is announced at least 48 hours ahead. We also tell customers about critical system changes that may affect their data.

Report a security issue

If you find a vulnerability or have a security concern, email security@365tune.com with the details and how to reproduce it. Please give us reasonable time to fix it before sharing it publicly.

Related documents

• Data Protection and Information Security Addendum
• Privacy Policy
• Terms of Service
• Service Level Agreement