Question 1

Is Yasoon UG SOC 2 compliant?

Accepted Answer

Yasoon UG is SOC 2 Type II compliant. On SOC2C this listing is Listed.

Question 2

Is Yasoon UG ISO 27001 certified?

Accepted Answer

According to Yasoon UG's public trust center, Yasoon UG is ISO 27001 certified. On SOC2C this listing is Listed.

Question 3

Is Yasoon UG SOC 2 Type I or Type II?

Accepted Answer

Yasoon UG is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.

Question 4

Can I use Yasoon UG's SOC 2 for a vendor risk assessment?

Accepted Answer

Yes. Yasoon UG's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Question 5

Is Yasoon UG penetration tested?

Accepted Answer

Yes — Yasoon UG undergoes third-party penetration testing as part of its security program. The pentest vendor is listed on its SOC2C profile.

Question 6

Does Yasoon UG have an ISO 27001 certificate?

Accepted Answer

Yasoon UG publishes an ISO certificate on its trust center; you can request access through SOC2C.

Question 7

Can I get Yasoon UG's SOC 2 report?

Accepted Answer

Yasoon UG's SOC 2 report is available on request. Request access through SOC2C and we coordinate the company-side NDA and delivery.

Question 8

Does Yasoon UG have a penetration test report?

Accepted Answer

Yasoon UG publishes a penetration test summary on its trust center. You can request access to it through SOC2C.

Question 9

Is Yasoon UG secure?

Accepted Answer

Security isn't a single yes/no, but Yasoon UG is SOC 2 Type II compliant and holds ISO 27001, SOC 2 Type II, and undergoes third-party penetration testing. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Question 10

Does Yasoon UG have a bug bounty or vulnerability disclosure program?

Accepted Answer

Yasoon UG hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@yasoon.com or via a /security page (Yasoon UG lists a security contact).

Question 11

Who are Yasoon UG's subprocessors?

Accepted Answer

Yasoon UG lists 7 subprocessors on its trust center, including Amazon Web Services, Microsoft 365, LogRocket, Sentry, Mailchimp. Buyers use this for fourth-party risk review.

Question 12

Where does Yasoon UG host or store data?

Accepted Answer

Yasoon UG hosts on AWS, and handles Customer personally identifiable information, Employee personally identifiable information, Credit card information, Personal health information. Data residency details are on its trust center.

Question 13

Where is Yasoon UG's trust center or security page?

Accepted Answer

Yasoon UG's trust center is at https://trust.yasoon.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Question 14

Where are your servers located (data residency)?

Accepted Answer

Our apps are hosted in our infrastructure in Frankfurt, Germany (AWS). Data residency with world-wide locations is coming soon. Learn more: Data residency

Question 15

Which data are stored and processed by Microsoft 365 for Jira?

Accepted Answer

Data storage We only store content that has been explicitly created by our apps. Most common data we store are: - User / instance settings - Metadata mappings between Atlassian & Microsoft objects - User login tokens retrieved by OAuth login We do not store Jira content (like Jira issues, comments, etc.) or Microsoft content (like chat content) on our servers. In some cases, we do store PII and / or OII data, in conformance with the GDPR. Data process We process data from your Jira, Microsoft 365 as well as our own data in our infrastructure in Frankfurt. This can be divided in data where the user directly interact and non user-interaction data. Examples for user interactions are: - Sending an email from Jira - Starting a Microsoft Teams chat from Jira - Creating a new Jira issue from Microsoft Teams Examples for non user-interactions are: - A Jira issue is updated and a Teams notification should be sent. - A Jira issue card is posted in a Microsoft Teams channel and the Teams bot links the issue to the conversation. - A task in Microsoft To Do is completed and a Jira issue should change it’s status. Find more information in our documentation: Data storage and processing

Question 16

Do you have a DPA?

Accepted Answer

You'll find our Data Processing Agreement (DPA) here: Data Processing Addendum

Question 17

Are there any differences between your Cloud and Data Center apps regarding security and legal?

Accepted Answer

Our data flows are almost identical regardless of the hosting option. This means that Jira Cloud and Jira Data Center have similar data storage and processing guidelines. To set up our Microsoft 365 for Jira, you need to make sure that your self-hosted version of Jira is publicly reachable. For more details, please refer to our documentation: Jira Data Center Fundamentals As for legal differences, we do have a Data Center specific amendment in our EULA, see here: EULA (yasoon.com)

Question 18

Do you encrypt data at rest?

Accepted Answer

Data transferred from and to our services are encrypted with TLS 1.2. The implementation of TLS enforces the use of strong ciphers and key-lengths where supported by the browser. All customer data that are stored in our environment are encrypted on data drive level. Additionally there are data we consider sensitive (e.g. access tokens) not even our support staff should have access to. These data are additionally encrypted within the database with AES-256.

Question 19

Do you have a retention procedure?

Accepted Answer

We shall retain data as long as the company has a need for its use, or to meet regulatory or contractual requirements. Once data is no longer needed, it shall be securely disposed of or archived. Learn more about data retention in our DPA: DPA - Data Processing Addendum (yasoon.com)

Question 20

How long will customer data be saved after cancelation of the license?

Accepted Answer

Customer accounts and data shall be deleted within 60 days of contract termination through automated data deletion processes.

Question 21

Which permissions from Microsoft and Jira are required for utilizing Microsoft 365 with Jira?

Accepted Answer

We only use the data to provide app features. We try to request as little permissions as possible, but unfortunately, some permissions are too broad. We are constantly working with Atlassian and Microsoft to improve this. Check out our documentation to get an overview: Permissions

Question 22

Where can I learn more on your privacy and security topics?

Accepted Answer

We documented all privacy and security topics in our Trust Docs. There you can also find a lot of security questionnaire topics answered: Security questionnaires

Question 23

What is the Standard Marketplace EULA from Bonterms?

Accepted Answer

Atlassian offers the Bonterms Standard Agreement for Marketplace Transactions (“Bonterms Standard Agreement”) as a streamlined end-user contracting option in the Atlassian Marketplace. By adopting the Bonterms Standard Agreement, we as a Marketplace Partners can benefit from a balanced agreement representing industry best practices and make it easy and fast for our customers to review and purchase our apps - and various other apps on the Atlassian Marketplace. With only a few amendments (as suggested by Bonterms), you can find our version of the Bonterms EULA here: EULA (yasoon.com)

Yasoon UG

About

Compliance & infrastructure

Documents

Subprocessors

Compliance leadership

Penetration test

Recent updates

This listing is partial

Frequently asked

Technology peers that completed SOC 2

Action1

ELJUN LLC

equipifi

IntelligentSystems Corp