Contact us

Data Storage & Security

At Virtosoftware, we understand that the security of your data is of utmost importance, which is why we use state-of-the-art security measures to keep your information safe. Our data storage and security framework follows Microsoft’s data protection standards. Virto Calendar takes part in the Microsoft 365 App Compliance Program at the Publisher Attestation level: a self-assessment that Microsoft publishes on Microsoft Learn without independently verifying it. It does not currently hold Microsoft 365 Certification, the program level that includes an independent audit.

Virto Calendar App Security Summary

1. Hosting & Architecture

  • Azure hosting: Our application engine runs exclusively in VirtoSoftware’s Microsoft Azure subscription with no components deployed on premises servers
  • Multi-tenant by default: The service is registered as a multi-tenant app in Microsoft Entra ID, following Microsoft’s guidance for least-privilege, conditional-access-aware SaaS solutions

2. Data Flow & Storage

  • Delegated access only: The app calls Microsoft Graph solely with delegated tokens that inherit the signed-in user’s rights; we never use application-level permissions
  • Ephemeral in-memory processing: Calendar payloads are processed in encrypted RAM and discarded at session end; no customer content is written to any Virto-controlled persistence layer
  • Application metadata: app settings, such as calendar configuration and data-source definitions, are stored encrypted in VirtoSoftware’s Azure; your events and list items are not
  • Token handling: The app uses delegated OAuth tokens. Token storage, lifecycle and protection controls are described in the Security Whitepaper

3. Compliance

  • Microsoft 365 App Compliance — Publisher Attestation: a self-assessment published on Microsoft Learn, not an audit. Virto Calendar does not currently hold Microsoft 365 Certification. VirtoSoftware does not hold SOC 2 or ISO/IEC 27001 certification and does not plan to obtain it
  • Aligned to Microsoft Teams service-level security: Our solution inherits Microsoft 365 defense-in-depth controls and can operate under customer Conditional-Access policies

4. Deploy into Your Tenant

For organizations with strict security requirements, or whose policies require vendor certifications such as SOC 2 or ISO/IEC 27001, we offer a custom build that you host in your own Azure subscription and Microsoft 365 tenant. This model provides full administrative control, keeps all telemetry within your environment, and runs under your own security controls and certifications. Implementation follows Microsoft’s SPFx/Teams app deployment checklist and can be delivered as an SPPKG or ARM template.

5. Alignment with Industry Best Practices

  • Zero-Trust (“never trust, always verify”): Architecture aligns with NIST SP 800-207 and Entra Conditional-Access enforcement
  • Least-privilege OAuth scopes: Only per-user delegated scopes are requested; no broad application roles
  • Encrypted transport & storage: TLS 1.2+ in transit; no at-rest customer data on Virto side
  • Secure session handling: Calendar objects are processed in server memory and are not written to disk, echoing OWASP secure-coding checklists
  • Scalable in-memory cache hygiene: Azure-native memory-management recommendations followed to prevent eviction leaks

For more information, please check the Security FAQ.

Updated on October 21, 2026