Snapshot 143704
Normalized text
Scripts and page chrome removed; this is what change detection compares.
CoreView's internal security and compliance overview CoreView is committed to the highest standards of security, holding top certifications and surpassing even the most rigorous requirements. Learn more Ensuring unmatched M365 security and compliance ISO 27001 & ISO 27018 CoreView is ISO 27001 and ISO 27018 certified, demonstrating our expertise and commitment to international standards for data security and privacy. These certifications provide our customers with confidence that their data is protected to the highest standards. SOC 2, Type II & SOC 3 CoreView holds SOC 2 Type II and SOC 3 compliance, recognized standards for transparency in security. Regular third-party audits ensure that our security posture meets and exceeds the most demanding industry requirements. ISO 9001 Certification Our ISO 9001 certification reflects CoreView’s dedication to quality and customer satisfaction. It highlights our commitment to operational excellence, delivering reliable solutions and securing M365 environments with superior standards. IRAP CoreView is IRAP certified, ensuring alignment with the Australian government’s stringent security requirements. This demonstrates our ability to meet and surpass regulatory standards for safeguarding sensitive data. CIS Benchmarks CoreView integrates CIS Benchmarks, providing robust tools and resources to implement the Critical Security Controls. Our adherence supports organizations in strengthening their cybersecurity strategies. Microsoft Partner As a Microsoft Partner, CoreView meets Microsoft’s rigorous security and business standards. This recognition validates our advanced expertise and trusted partnership. Comprehensive security and compliance framework Infrastructure and data management Our application is hosted on Microsoft's Azure cloud platform with data centers located in North Europe, East US, East US (GCC), Canada East, Australia East, and UK South. We ensure logical partitioning of customer tenants to maintain data separation and security. To guarantee continuous monitoring and security, our platform is observed around the clock using a combination of Microsoft Sentinel, Azure Monitoring, Azure Application Insights, Zabbix, Grafana, and Sysdig. For real-time updates on our system's status, please visit our public status dashboard at https://status.coreview.com. Data We ensure that all data is encrypted both in transit and at rest using AES-256 encryption. Only metadata is collected through the Microsoft Graph API using service accounts with the Global Reader role. These accounts are secured using Conditional Access policies that restrict access to specific IP addresses. For US Government customers, data is securely hosted within the Microsoft Azure Government Community Cloud (GCC). Access control Our application is hosted in Azure, leveraging Microsoft's physical data center controls. Privileged access by CoreView personnel is strictly based on job necessity and is facilitated through a set of security facilities combined with jumpboxes, which have exclusive access to specific IP addresses. All activities are logged in a SIEM platform, and video recordings of sessions are retained for 10 years. Operator access Operators use Single Sign-On (SSO) with Microsoft accounts, ensuring that no credentials are stored in CoreView. Multifactor authentication is enforced for added security. In advanced management mode, service account details are securely stored in Azure Key Vault. Vulnerability management We conduct ongoing and continuous monitoring of virtual machines, networks, and services using Microsoft Defender for Cloud. Static code analysis is integrated into our Continuous Integration process. Code quality is maintained through a rigorous Pull Request process, which is reviewed by a dedicated team of Senior Software Engineers. We check software package vulnerabilities using Trivy. CoreView employees All staff are required to complete annual security and compliance training. Background checks are conducted during the hiring process. End-user computers are protected with tools such as Microsoft Intune, DLP, Microsoft Defender, and firewalls. We conduct constant simulations of phishing, social engineering, and other cybersecurity threats to maintain a high level of security awareness. Only a specific set of employees, who have signed a specific agreement with CoreView, are authorized to access data centers directly in case of incidents. Business continuity We have a documented Business Continuity Plan that is tested every 12 months. Disaster Recovery and Backup/Restore procedures are regularly updated and tested as part of our Industry Standards Certification process. Automated patching is managed through Azure Update Manager, ensuring no impact on live services. We maintain a Service Level Agreement (SLA) of 99.9%. Proactive security activities We use Microsoft Web Application Firewall for continuous attack protection. Regular penetration testing is conducted by a third-party security company at least once a year. Keys and passwords are rotated constantly to enhance security. Responsible disclosure policy If you discover a vulnerability in a CoreView application, please submit a report via a support ticket. We carefully review all security concerns and continuously monitor the latest threats, collaborating with external researchers and organizations to stay ahead. If you believe your account is compromised or notice suspicious activity, report it immediately to your application administrator and contact support@coreview.com. Need more information? For additional details, feel free to reach out to your Account Executive or Partner Manager. Further information is available upon request and may require a nondisclosure agreement. Read privacy policy CoreView is the leading SaaS platform for Microsoft 365 Tenant Resilience. Trusted by enterprises worldwide, CoreView secures the configuration, identity, and access layers of Microsoft 365 across Exchange Online, Teams, SharePoint, OneDrive, Intune, and Entra ID. It hardens tenants against attack, reduces privilege and blast radius, detects configuration tampering, and restores security posture after incidents. By protecting these workloads at the tenant level, CoreView ensures organizations can prevent compromise, withstand intrusion, and recover with confidence from cyber threats and operational disruption. Quick links PricingGet a demoTake a tourCoreView ONE login Company About UsContact UsReviewsNewsroom Follow Us: Privacy policy | Terms & conditions | Terms of service | Service level agreement | Legal overview | Security & compliance © YEAR CoreView. All rights reserved.