Security & Compliance
For IT, security and legal reviewers. Last reviewed October 20, 2026.
This page answers the questions a vendor review asks first. It is a summary: the licence agreements and the Data Processing Agreement linked below are the documents that govern.
In short: the standard Virto apps for Microsoft 365 and Teams do not store your content; it stays in your Microsoft 365 tenant. VirtoSoftware does not hold its own SOC 2 report or ISO/IEC 27001 certificate and does not plan to obtain them; if your policy requires them, we deploy the apps into your own tenant. We fill in your own security questionnaire, and we send the DPA and our security policies on request.
Who we are
VirtoSoftware UAB, Ozo g. 12A, Penta Technopolis, LT-08200 Vilnius, Lithuania. We have built apps for SharePoint and Microsoft 365 since 2001. As an EU company, we process personal data under the GDPR. NATO lists us under NCAGE code 0273R.
Where your data is
| Product | Where your content is | What VirtoSoftware runs |
|---|---|---|
| Virto apps for Microsoft 365 and Teams, such as Virto Calendar App, Virto Kanban Board App, Virto Alerts & Reminder App and Virto Forms Designer App | In your Microsoft 365 tenant: SharePoint lists, Exchange calendars, Planner and the other sources you connect | The app backend on Microsoft Azure in the US. It processes content in memory to show it to the signed-in user and does not write it to disk. |
| Virto Shared Calendar | On Microsoft Azure, managed by VirtoSoftware | The app and its storage. This is the one cloud product that keeps your calendar data with us. |
| On-premises web parts for SharePoint Server | On your own servers | Nothing: the product runs in your farm. |
Access to Microsoft 365. The apps call Microsoft Graph with delegated permissions: each request runs with the rights of the person who is signed in, so a user sees only what they can already see in Microsoft 365. A tenant administrator grants consent once for the organisation. VirtoSoftware staff cannot open your content without your credentials.
Deploy into Your Tenant. If your policy does not allow third-party SaaS, or requires SOC 2 or ISO/IEC 27001 from vendors, an Enterprise agreement runs the apps in your own Azure subscription and Microsoft 365 tenant, under your own security controls and certifications. See Deploy Virto apps in your own Azure.
Certifications and testing
| Question | Answer |
|---|---|
| SOC 2 report for VirtoSoftware | We do not have one and do not plan to. If your policy requires it, use Deploy into Your Tenant. |
| ISO/IEC 27001 certificate for VirtoSoftware | We do not have one and do not plan to. Our policies use ISO/IEC 27001 and the NIST Cybersecurity Framework 2.0 as reference frameworks; no auditor has certified them. |
| HIPAA, FedRAMP | We do not hold them. |
| Hosting | Microsoft Azure. Azure’s own certifications, SOC 2 and ISO/IEC 27001 among them, cover the infrastructure, not VirtoSoftware’s processes. Microsoft publishes them in the Service Trust Portal. |
| Microsoft 365 app compliance | Virto Calendar App, Virto Kanban Board App and Virto Shared Calendar have completed Microsoft Publisher Attestation. It is a self-assessment that Microsoft publishes on Microsoft Learn, not an audit. |
| Penetration testing | NATO tested Virto Kanban Board Web Part for SharePoint Server in March 2024. The one vulnerability it found, CVE-2024-34400, was fixed. That test covered the on-premises product only. Read the NATO case. |
Data protection and privacy
- Data Processing Agreement. A GDPR Article 28 DPA covers the Virto apps for Microsoft 365 and Teams. You can request it without an NDA.
- Sub-processor. Microsoft, as the Azure hosting provider. We give 30 days' notice before adding a new one.
- Transfers outside the EU rely on Microsoft’s data protection addendum, with the EU standard contractual clauses and the EU-US Data Privacy Framework.
- Virto Shared Calendar keeps your calendar data with us, so its data processing terms are agreed separately. Ask us before you buy it.
- Privacy contact: dpo@virtosoftware.com. How we handle the data we control ourselves, such as account and usage data, is in the Privacy Policy.
Licence terms at a glance
The current agreements are the EULA for Microsoft 365 and Teams and the EULA for On-Premises Products, both version 10.3. The Terms of Service page explains which one applies. The terms legal teams ask about most:
| Term | What the EULA says |
|---|---|
| Limitation of liability | Each party’s total liability is capped at the fees paid for the affected product in the 12 months before the claim. Neither party is liable for indirect or consequential damages. The exceptions include death or personal injury caused by negligence, fraud, wilful misconduct or gross negligence, and liability the law does not allow to be limited; the full list is in the EULA. |
| Data protection liability | Set out in the DPA, not in the EULA. |
| Governing law | The law of the Republic of Lithuania; the courts of Vilnius. |
| Order of precedence | Your order comes first, then the DPA for data protection, then the EULA. |
| Changes | Only in writing and signed by VirtoSoftware. |
If your legal team needs different terms, send its comments to our sales team. What we agree becomes part of your order, and your order takes precedence over the EULA.
How to run your review with us
- Read this page and the EULA for your product.
- Request the DPA through the request form. No NDA is needed.
- Request the security documents under NDA: the Security Whitepaper and our policies for information security, access control, incident response, secure development and change management. They are in the Trust & Security Center.
- Send us your security questionnaire. We fill in your organisation’s own form; we do not have a pre-filled CAIQ or SIG.
- Send your legal comments on the EULA or DPA to our sales team.
To report a security vulnerability, write to support@virtosoftware.com with the subject “Security Vulnerability Report”.
Talk to our team
Send us your security questionnaire or your legal team's comments, or book a call to go through your review.