Data Security FAQ
1) Are Virto apps hosted on-premises, by VirtoSoftware, cloud-hosted, or other?
The engines of Virto applications are hosted in Microsoft Azure servers. The apps can be added to your SharePoint site pages or Microsoft Teams channels.
2) Can VirtoSoftware access my company’s resources or data?
No. Your content stays in your Microsoft 365 tenant, and we do not have access to it. Virto apps use delegated permissions or your end users’ permissions. End users can access only the data they are allowed to access in Microsoft 365.
The exceptions are Virto Shared Calendar and Virto Polls: Virto Shared Calendar stores shared calendar data and Virto Polls stores polls and poll responses on VirtoSoftware-managed Azure infrastructure, and their data processing terms are agreed separately.
3) Will VirtoSoftware store/host data?
VirtoSoftware does not store your content (documents, emails, calendar events, list items). We keep only application metadata, such as app settings, encrypted in our Azure infrastructure (see the Security Overview). Virto Shared Calendar and Virto Polls are the exceptions described above. The tool can only access the provided permissions when this user works within the Virto app. A private key is generated for this session, and nobody except this user reuses it for future data access. A new private key will be generated for a new session.
4) Do you scan your applications for security vulnerabilities? If so, can we have a copy of the most recent scan?
Yes. We run automated dependency scanning (npm audit, Dependabot) and fix critical vulnerabilities within 7 days and high-severity ones within 30 days. Scan output is internal; our Security Testing & Vulnerability Management Statement is available under NDA from the Trust & Security Center.
5) Do you do penetration testing of your applications?
Yes. The NATO Cyber Security Centre (NCSC) has penetration-tested seven Virto components for SharePoint Server (on-premises): Virto Kanban Board Web Part in March 2024; Virto Calendar Web Part, Virto Notifications & Alerts Web Part, Virto Bulk File Download, Virto Workflow Status Monitor, Virto Tab Navigation and the Cross-Site Lookup Selector of Virto Cascade Lookup Web Part, most of them in spring 2026. VirtoSoftware holds the NCSC disclosure report for each test, and every finding from the seven tests has been fixed; the one vulnerability found in Kanban Board, CVE-2024-34400, within 7 business days. The tests covered these on-premises products only, not the Microsoft 365 and Teams apps. See the components and versions tested.
6) Is the data encrypted in transit?
Yes. Data is encrypted in transit with HTTPS (TLS).
7) Will VirtoSoftware provide remote access for training, troubleshooting, or service maintenance? If so, what type of remote access will be utilized?
We provide remote access for troubleshooting, but it is not required for service maintenance. We always initiate it from our side. Remote access can be used for training (additional cost may apply). We usually utilize Microsoft Teams for remote connections.