1. Our security policy
Management has set the following principles for handling information. They apply to all employees and to all systems we use to provide services to our customers.
- We protect the confidentiality, integrity and availability of our customers' and our own information.
- Access to information is only granted to those who need it for their work (need-to-know).
- We comply with legal and contractual requirements, in particular the GDPR, the German GoBD and the Cyber Resilience Act.
- We continuously improve our security measures.
- All employees receive regular information security training.
- Security incidents and suspected incidents must be reported. Reporting never leads to disadvantages for the person reporting.
2. ISO/IEC 27001 status
We are establishing an information security management system according to ISO/IEC 27001:2022 and aim for certification.
3. Hosting and data location
Our cloud services run on Microsoft Azure in the Germany West Central region (Frankfurt am Main). The service providers that process personal data on our behalf are listed under Sub-processors.
4. Secure development
- Every code change is reviewed by a second person in a pull request.
- The build pipeline checks every change automatically.
- Every release on Microsoft AppSource goes through Microsoft's validation.
- We assess and fix vulnerabilities in our apps and services following a defined process. To report a vulnerability, see Vulnerability disclosure.
The individual measures are described in the technical and organisational measures.
5. Availability
The current state of our services is shown on the status page. The committed availability is defined in the Service Level Agreement.
6. Documents
7. Contact
For security questions and customer security questionnaires, contact us at security@365businessdev.com.
Found a security vulnerability? Please use our reporting process under Vulnerability disclosure.
Last updated: November 2, 2026