Secure Development Lifecycle Policy
Document Title: Secure Development Lifecycle Policy
Classification: Confidential - Under NDA
Document Owner: Alex Linnik, Chief Technology Officer
Version: 3.2
Revision Date: October 28, 2026
Approved By: Sergi Sinyugin (CEO), Alex Linnik (CTO)
Next Review: October 2027
Company Information:
VirtoSoftware UAB
Penta Technopolis, Ozo g. 12A
Vilnius, Lithuania 08200
Email: support@virtosoftware.com
Phone: +1 877 892-7775
Website: www.virtosoftware.com
1. Purpose and Scope
This policy establishes security practices for VirtoSoftware Microsoft 365 application development. Security is built into products through practical, automated controls appropriate for our development team.
Key Differentiator: No standing access to customer content — in zero-access applications, content remains in the customer’s Microsoft 365 tenant (Virto Shared Calendar and Virto Polls excepted). Applications use OAuth 2.0 with user-delegated permissions only.
Applies to:
- All VirtoSoftware products (Microsoft Teams apps, SharePoint apps, Office add-ins)
- Development team and CTO
- Azure infrastructure and CI/CD pipelines
Key Principle: Automate security where possible (80% automated), manual review only where necessary (20% manual).
For more information