SurePosture
Free trial

Trust centre

Security, privacy and compliance in one place.

SurePosture holds privileged read access to the tenants you manage. This is what we do to deserve it, and where to find the detail your clients and auditors will ask for.

  • Data hosted in the EU (Frankfurt)
  • Read-only by default
  • No tenant content read

Access and permissions

Read-only application permissions granted by your administrator. Write access is a separate, optional consent.

See every permission

How data is protected

Sign in with Microsoft or two-step verification, workspace isolation, encrypted credentials, hashed secrets and an append-only audit log.

Security controls

What is read and kept

Configuration, never content: no mail, files, chats or calendars. Snapshots are trimmed to the fields checks use.

Data inventory

Sub-processors

Render for hosting, [email delivery provider] for email and Stripe for billing.

Sub-processor list

Privacy

One strictly necessary cookie. No advertising trackers. Your rights under UK data protection law.

Privacy notice

Service status

Live checks of the application, database, background processing and integrations.

Current status

Compliance

Certifications and documents

SurePosture does not yet hold an independent certification such as Cyber Essentials, ISO/IEC 27001 or SOC 2. When it does, certificates will be listed here with a link to verify them.
  • Data processing agreementUK GDPR Article 28 terms for processing tenant data.Request
  • Security questionnaireAnswers for your or your client's supplier review.Request

Vulnerability disclosure

Found a security issue? Tell us.

We welcome reports from security researchers and customers, and will work with you to understand and fix them.

Email [security contact email] with a description of the issue, the steps to reproduce it and its likely impact. Our contact details are also published in security.txt.

When you test, please:

  • only use accounts and workspaces you own or have permission to test;
  • never access, change or delete another customer's data, or any Microsoft 365 tenant data;
  • avoid anything that degrades the service for others, such as denial of service or automated scanning at volume;
  • give us reasonable time to fix the issue before telling anyone else.

We will acknowledge your report, keep you informed while we investigate, and tell you when it is fixed. Social engineering, physical attacks and reports from automated scanners without a demonstrated impact are out of scope.