Trust is a posture you can check.

SOC 2 ↓ Infrastructure ↓ Sign-in ↓ GDPR ↓ Platform ↓ Never-say ↓

CSPify's SOC 2 Type II program is in progress: controls are being implemented and evidenced, with the Type I audit first and Type II to follow. We don't hold SOC 2 today, and this page will not say we do until a report exists. When it does, this page changes the same week. Ask for the current control list at any point — it's the same list the auditor will see, and we'd rather show it to you now than adjective our way around it.

Status: program in progress · Type I first, Type II to follow · No certification claimed today.

CSPify runs on Microsoft Azure. Microsoft maintains ISO 27001, SOC 1, SOC 2 and SOC 3 certifications — among others — for Azure datacenters and services, attested in Microsoft's own audit reports. Those certifications belong to Microsoft's infrastructure. CSPify does not inherit them, and we don't claim them as our own — our own application-level certification is the SOC 2 roadmap above. What Azure's posture does mean in practice: physical datacenter security, network controls and platform compliance are handled by the same provider that runs your Microsoft 365 tenants.

Infrastructure compliance: maintained by Microsoft. App-level certification: our own roadmap. We know the difference.

• Microsoft-native OpenID Connect SSO — sign-in happens in Microsoft's flow, against your tenant.
• No passwords stored by CSPify. There is nothing to breach in a password database we don't have.
• MFA enforced by your own Entra ID policies — set it once in your tenant; it applies here automatically.
• Conditional Access support — your device, location and risk policies travel with the sign-in.
• Consent-based, least-privilege GDAP scopes — you grant exactly the access CSPify needs, per tenant, in Microsoft's own consent flow.
• Connections are consent-based and read-only where read-only suffices, revocable at any time, and expire after 30 days.

Sign-in: Microsoft External Entra ID (OIDC) · MFA & Conditional Access: your policies · Passwords stored by CSPify: none.

• Data Processing Agreement (GDPR Art. 28) available on request, including Standard Contractual Clauses and the UK IDTA/Addendum.
• Hosted on Microsoft Azure — Australia East today — with EU-region deployment on Azure available on request for EU/UK customers.
• Consent-based Microsoft GDAP connections: read-only, revocable, expiring after 30 days.
• A data-minimising identity model: PrincipalIds and salted hashes, not personal profiles.
• Right to erasure honoured through identity-record removal.
• 72-hour breach-notification commitment.
• A published sub-processor list — ask, and it's yours.
• No sale of customer data. Ever.
• International transfers covered by the EU-US Data Privacy Framework where applicable, with SCC fallback.

GDPR-ready is a posture, not a certificate. There is no such thing as “GDPR certified” — and we don't claim it.

23/23 isolation tests passing · Audit trail on every action · TLS in transit · Encrypted at rest.

• “GDPR certified” — No such certification exists. Anyone using the phrase is selling fog.
• “Military-grade encryption” — Marketing fog, not a control. We name the actual mechanism instead: TLS in transit, encrypted at rest.
• “Fully compliant” — Compliant with what, measured how? The specifics are above; the adjective stays off.
• “100% secure” — Nobody is. We test, log and patch instead of promising.
• “Backed by Azure's certifications” — Azure's certifications are Microsoft's. Ours is the SOC 2 roadmap above — in progress, and labelled that way.

If a claim on this page ever stops being true, the page changes — the same week, not the next rebrand.