VirtoSoftware Security Overview

Public Version#

Document Title: Security Overview
Classification: Public
Version: 3.1
Revision Date: October 20, 2026
Effective Date: October 20, 2026
Next Review Date: October 2027

Company Information:

VirtoSoftware UAB
Ozo g. 12A, Penta Technopolis
LT-08200 Vilnius, Lithuania

Email: support@virtosoftware.com
Phone: +1 (877) 892-7775
Website: www.virtosoftware.com

1. Introduction#

VirtoSoftware is committed to providing secure, enterprise-grade applications for Microsoft 365 environments. This overview summarizes our security approach, independent testing, and available documentation. For detailed information about our security architecture, policies, and procedures, please contact us to request our comprehensive security documentation package comprising 7 detailed policy documents (available under NDA).

1.1 About VirtoSoftware#

VirtoSoftware has built apps for SharePoint and Microsoft 365 since 2001. VirtoSoftware UAB is a Lithuania-based software company specializing in enterprise productivity applications for Microsoft 365 and SharePoint environments. With 25 years of experience, we serve 15,000+ organizations worldwide, including NATO, NASA, Baker McKenzie, Warner Bros, Disney, Sony, US Treasury, and Texas Instruments. Our apps for SharePoint, Teams, and Microsoft 365 are published on Microsoft AppSource.

NATO NCAGE Code: 0273R

2. Our Security Approach#

2.1 Your Data Stays Yours (Zero-Access Architecture)#

In our standard SaaS model, VirtoSoftware has no standing access to your content. For applications covered by the Zero-Access Architecture, customer content created and managed by our applications is stored directly within your Microsoft 365 tenant (SharePoint Lists, Microsoft Dataverse, etc.). Application metadata, such as UI preferences and app configuration, is stored in VirtoSoftware-managed Azure. Our application backend, hosted on our Azure servers, processes business logic in RAM only — customer content data is never written to disk and is automatically cleared when the session ends.

Exception — Virto Shared Calendar. The Zero-Access Architecture applies to VirtoSoftware’s Microsoft 365 applications where customer content is stored in the customer’s Microsoft 365 tenant. Virto Shared Calendar is the exception: it stores shared calendar data on VirtoSoftware-managed Azure infrastructure, and its data processing terms are agreed separately. Contact sales@virtosoftware.com before you buy it.

Data Access Comparison#

2.2 Two Deployment Options#

We offer flexible deployment models to meet diverse security and compliance requirements:

1. Standard SaaS Model — Our multi-tenant application hosted on VirtoSoftware’s Azure infrastructure, with your data remaining in your M365 tenant.
2. Deploy into Your Tenant — the application is deployed in your own Azure subscription and Microsoft 365 tenant and runs under your security controls, monitoring, and compliance certifications. Recommended for organizations whose policies require vendor certifications such as SOC 2 or ISO 27001 (see Section 6).

For more information, visit virtosoftware.com/deploy-virto-apps-in-m365 or contact our sales team at sales@virtosoftware.com.

3. Compliance Programs & Independent Testing#

3.1 Microsoft 365 Publisher Attestation#

VirtoSoftware has Microsoft AppSource listings with published Publisher Attestations under the Microsoft 365 App Compliance Program. Publisher Attestation is a developer self-assessment: we answer Microsoft’s questionnaire on the app’s security, data handling, and compliance, and Microsoft publishes the answers on Microsoft Learn without independently verifying them. Attestation status varies by listing; it is not shown for every VirtoSoftware offer. No VirtoSoftware app currently holds Microsoft 365 Certification, the program level that includes an independent audit.

About the program: learn.microsoft.com/en-us/microsoft-365-app-certification/docs/attestation

Our apps: Microsoft AppSource — appsource.microsoft.com/en-us/marketplace/apps?search=virtosoftware

3.2 NATO Penetration Testing (2024–2026)#

The NATO Cyber Security Centre (NCSC) has penetration-tested seven Virto components for SharePoint Server (on-premises): Virto Kanban Board Web Part in March 2024; Virto Calendar Web Part, Virto Notifications & Alerts Web Part, Virto Bulk File Download, Virto Workflow Status Monitor, Virto Tab Navigation and the Cross-Site Lookup Selector of Virto Cascade Lookup Web Part, most of them in spring 2026. VirtoSoftware holds the NCSC disclosure report for each test, and every finding has been fixed. The Kanban Board test identified vulnerability CVE-2024-34400, which was remediated within 7 business days. The tests covered these on-premises products only, not the Microsoft 365 and Teams apps.

Components and versions tested: virtosoftware.com/use-cases/virtosoftware-tested-by-nato/

3.3 NATO NCAGE Registration#

VirtoSoftware is registered in the NATO Codification System with NCAGE Code 0273R, enabling participation in defense and government procurement processes.

4. Key Security Practices#

4.1 Authentication & Authorization#

• Single Sign-On (SSO) via Microsoft 365 (Azure AD / Entra ID)
• OAuth 2.0 Delegated Permissions — Applications use delegated, user-level permissions: VirtoSoftware employees have no standing access to customer content, and the app can only access data that the authenticated user can access. OAuth tokens are protected by the controls described in the Security Whitepaper.
• Multi-Factor Authentication (MFA) enforced for all VirtoSoftware employee administrative access; customer MFA policies inherited from customer’s Azure AD configuration.

4.2 Data Protection#

• TLS 1.3 encryption for all data in transit
• No customer content storage on VirtoSoftware servers in standard SaaS model; application metadata is stored in VirtoSoftware-managed Azure, and Virto Shared Calendar stores calendar data there (see Section 2.1)
• GDPR compliant with Data Processing Agreement (DPA) available on request

4.3 Development Security#

• Secure Development Lifecycle (SDLC) with mandatory code reviews by senior developers
• Microsoft Visual Studio and Azure DevOps development environment
• Automated dependency scanning (npm audit, Dependabot) and regular vulnerability updates
• Strictly limited administrative access with MFA enforcement

4.4 Platform Security#

Built on Microsoft Azure infrastructure, which independently maintains:

• SOC 2 Type II certification
• ISO 27001 compliance
• GDPR, HIPAA, and FedRAMP compliance
• Global threat intelligence and protection

VirtoSoftware inherits these infrastructure-level controls and implements additional application-level security measures documented in our Security Whitepaper.

Full details: microsoft.com/en-us/trust-center

5. Security Documentation#

We maintain comprehensive security documentation to support your security and compliance requirements. Our documentation covers all aspects of information security, from development practices to incident response procedures.

5.1 Available Publicly#

• This Security Overview — High-level summary of security practices and independent testing
• Privacy Policy — Data collection, processing, and privacy practices (virtosoftware.com/privacy-policy/)
• Terms of Service — Legal terms and conditions for using VirtoSoftware applications

5.2 Available on Request (No NDA Required)#

• Data Processing Agreement (DPA) — GDPR-compliant data processing terms, roles, and responsibilities

5.3 Available Under NDA#

For enterprise customers and security reviews, we provide detailed security documentation under Non-Disclosure Agreement (NDA):

• Security Whitepaper — Comprehensive technical security architecture, controls, and best practices
• Information Security Policy — Enterprise security framework, risk management, and compliance standards
• Access Control Policy — User authentication, authorization, and access management procedures
• Change Management Policy — Production deployment controls, approval workflows, and rollback procedures
• Incident Response Policy — Security incident detection, response, and notification procedures
• Secure Development Lifecycle (SDLC) Policy — Secure coding standards, testing, and deployment practices

To request our comprehensive security documentation package, please contact:

Email: support@virtosoftware.com  |  Subject: Security Documentation Request

6. Compliance & Standards#

VirtoSoftware security policies and practices are aligned with industry-leading frameworks and standards:

• GDPR (General Data Protection Regulation) — Full compliance with EU data protection requirements
• NIST Cybersecurity Framework 2.0 — Risk-based approach to managing cybersecurity
• OWASP Top 10 — Mitigation of common web application security risks
• Microsoft 365 App Compliance — Publisher Attestation (self-assessment published on Microsoft Learn; not an audit)

Our infrastructure provider, Microsoft Azure, maintains additional certifications including SOC 2 Type II, ISO 27001, HIPAA, and FedRAMP. They cover the infrastructure, not VirtoSoftware’s processes.

SOC 2 and ISO 27001. VirtoSoftware does not hold SOC 2 or ISO/IEC 27001 certification and does not plan to obtain it. Organizations whose policies require these certifications from their vendors can choose Deploy into Your Tenant (Section 2.2): the application runs in the customer’s own Azure subscription and Microsoft 365 tenant, under the customer’s own security controls and certifications.

7. Vulnerability Reporting & Responsible Disclosure#

VirtoSoftware welcomes reports from security researchers and customers who discover potential vulnerabilities in our applications or infrastructure.

• Report to: support@virtosoftware.com with subject “Security Vulnerability Report”
• Initial acknowledgement: within 2 business days
• Assessment and response: within 7 business days
• Safe harbor: We will not pursue legal action against researchers who report vulnerabilities in good faith and follow responsible disclosure practices.

8. Contact Us#

For security inquiries or to request our comprehensive security documentation package:

Version History#

Document Classification: Public

Copyright: © 2001–2026 VirtoSoftware UAB. All rights reserved.