Incident Response Policy v3.2
Version: 3.2
Effective Date: October 28, 2026
Last Reviewed: October 28, 2026
Document Owner: Alex Linnik, CTO
Next Review: October 2027
1. Purpose
This Incident Response Policy establishes VirtoSoftware’s procedures for detecting, responding to, and recovering from cybersecurity incidents. The policy ensures consistent, effective incident management that protects customer data, maintains service availability, and meets GDPR requirements.
VirtoSoftware operates a Zero-Access Architecture where customer data remains in the customer’s Microsoft 365 tenant. This policy focuses on protecting VirtoSoftware’s Azure infrastructure, OAuth credentials, and application code while ensuring rapid response to any security events.
The Zero-Access Architecture applies to VirtoSoftware’s Microsoft 365 applications where customer content is stored in the customer’s Microsoft 365 tenant. Virto Shared Calendar and Virto Polls are the exceptions: Virto Shared Calendar stores shared calendar data and Virto Polls stores polls and poll responses on VirtoSoftware-managed Azure infrastructure, and their data processing terms are agreed separately.
2. Scope and Incident Classification
This policy applies to all security incidents affecting VirtoSoftware’s Azure infrastructure, applications, OAuth integrations, employee accounts, and development systems.
For more information