Younium AB Inc

Younium AB Inc's SOC 2 report is available on request. Request access through SOC2C and we coordinate the company-side NDA and delivery.

Younium AB Inc publishes a penetration test summary on its trust center. You can request access to it through SOC2C.

Security isn't a single yes/no, but Younium AB Inc is SOC 2 Type II compliant and holds SOC 2 Type II, GDPR, and undergoes third-party penetration testing. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Younium AB Inc hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@younium.com or via a /security page (Younium AB Inc lists a security contact).

Younium AB Inc lists 7 subprocessors on its trust center, including Cyclr, Frontegg, Microsoft Azure, Sendgrid Inc, StartDeliver. Buyers use this for fourth-party risk review.

Younium AB Inc hosts on Azure, and handles Customer personally identifiable information, Employee personally identifiable information, Credit card information, Personal health information. Data residency details are on its trust center.

Younium AB Inc's trust center is at https://trust.younium.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

yes, for more information about Privacy policy, visit Youniums public privacy policy

Younium stores customer data as long as the customer is using the service. If the customer will no longer use the service all customer data will be removed from the cloud. Before data is removed the data can be exported to the customer using a format agreed upon between the customer and Younium

Younium will not disclose customer data to a third party (including law enforcement, other government entity or civil litigant) except by request from customer or required by law. If compelled to disclose customer data to a third party, we will promptly notify the customer and provide a copy of the demand, unless legally prohibited from doing so. This policy is in line with Microsoft's policy for Microsoft Azure. Read more here: [](https://www.microsoft.com/en-us/trustcenter)https://www.microsoft.com/en-us/trustcenter

- Younium only processes our customers and their customers data according to the signed Data Processing Agreement - Younium ensures strong security measures to prohibit unauthorized access to the personal data. This includes encryption of data and access control.

Younium customers can select to either use the built in user login with email and password login, or a SSO connection where users are authenticated using the customers own identity provider (IdP) Multi-Factor Authentication Younium customers can choose to enable multi-factor authentication for their access to the Younium service by using built in MFA support for authenticator app using QR code. If SSO is used, the MFA options provided by their identity provider can be used. Single Sign On (SSO) Younium offers SSO configuration using either SAML or Open ID Connect (OIDC). When using SSO, the options for multi-factor authentication are tied to the identity provider the customer connects to Younium. Logging Younium logs all application actions on the API level. Logs are stored with 30 days retention.

All customer data hosted by Younium is encrypted using Microsoft Azure hosted keys 256-bit AES . The data transit is also encrypted at rest for application data, backups, and logs generated. [https://learn.microsoft.com/en-us/azure/security/fundamentals/encryption-atrest]

All Younium web applications and API services use HTTPS (HTTP over SSL). Any requests made to the Younium services require TLS protocol set to 1.2 minimum (1.3 Supported) A CDN global load balancing service handling the HTTPS certificate management for all publicly exposed services.

The built-in fault tolerance capabilities of Microsoft Azure protect customer data from individual server, network, and device failures. However, in order to protect customer data against user or application errors or a total loss of a region, Younium does also create a separate backup of the data. Incremental or full database backups are encrypted and managed by Microsoft. Additional geo-replicated backups are enabled on the critical cloud services hosting the customer’s data (Aligned with GDPR compliance).

Customer data is stored Globally, within Microsoft Azures cloud: - EU Wester Europe; Amsterdam - US East US; Virginia The region is agreed upon onboarding to Younium Failover Azure configuration data such as storage account replication is located in the Microsoft Azure North Europe region based in Ireland.

The recovery time objection (RTO) defines the duration of time and service level acceptable to restore the services after an incident, this one is handled based on the severity and type of incident encountered. The recovery point also called (RPO) in case of major data loss or corruption is strongly related to the Azure cloud services SLA and backup capabilities. Example scenarios: An extended outage of the Azure Cloud region West Europe Application error corrupts data and/or causes data loss (Single or all tenants) User (or application) error causes corrupt and irrecoverable data for a tenant The most critical Younium services are geo-replicated across different Azure regions. For example, the load balancer which routes the ingress network traffic can be routed to a passive instance in case of a major issue is detected.

Threat detection monitoring services are enabled to detect and notify the infrastructure administrators in case of suspicious data exfiltration and abnormal behavior detection. Security breaches and vulnerabilities detected are assessed by the different team's stakeholders as soon as the information has been generated. Once the severity level and scope of the issue have been assigned to the incident, all impacted customers will be contacted as soon as possible with the details and information available. Follow-up notifications including updates and status updates will also be sent out until the incident resolution. The severity level assigned during the initial assessment will then be discuss with the product and customer success managers before sending a nofication to the impacted customers.

Monitoring The availability and monitoring of the different services is managed via a combination of Datadog & Azure alerts. Each Younium service has a dedicated set of monitoring alerts, these ones are based on fixed or dynamic metrics thresholds. Custom logs generated by the application are processed and analyzed using the Datadog platform. Scaling The Younium architecture which combines a load balancer as an entry point and the Azure Paas services as the backend allows these different backend services to be scaled in case of performance issues or unexpected load increases. Status On the link below, the status and health of Younium and its integrations is presented. Current and past incidents are listed on this page. https://status.eu.younium.com/