OneDirectory is built on a security-first, least-privilege foundation. Your directory runs on Microsoft Azure, connects to Microsoft 365 with read-only access, and encrypts your data in transit and at rest. This overview summarises how we protect your organisation's information.
Hosting and infrastructure
OneDirectory is hosted entirely on Microsoft Azure, within Microsoft's secure, certified data centres.
Physical security, on-site access controls, and compliance are managed by Microsoft. Azure data centres hold certifications including ISO/IEC 27001/27018, SOC 1, SOC 2, SOC 3, and PCI DSS.
Edge security, including TLS, DNS, static-asset caching, and DDoS protection, is delivered through Cloudflare.
Database access is restricted by Azure firewalls on a deny-by-default basis, with only approved IP addresses permitted.
Where your data is stored
By default, data is hosted in Microsoft Azure data centres in the United States (Central US). For Enterprise customers, or where data-residency rules require it, alternative regions such as the European Union or Australia are available.
Encryption
In transit: all requests are encrypted using TLS 1.2+ with modern cipher suites and SHA-256 certificates.
At rest: data is encrypted with 256-bit AES, one of the strongest block ciphers available.
Backups: automatically encrypted with Azure Storage encryption (256-bit AES, FIPS 140-2 compliant) and transferred over HTTPS on the Azure backbone.
Key management: encryption keys are stored in Azure Key Vault.
Authentication and sign-in
Sign-in uses Microsoft Authentication. OneDirectory never sees or stores passwords, and there is no forms-based login.
Your users sign in with their Microsoft work accounts, which stay fully under your organisation's control.
Optional Seamless SSO (via Microsoft OpenID Connect) can sign users in automatically when they are already signed into Microsoft, ideal for linking from an intranet.
Your directory lives at your own subdomain: your-organization.onedirectory.com
What we can, and can't, access
OneDirectory reads your employee profile data through the Microsoft Graph API using a least-privilege, read-only permission model. We cannot write to or change anything in your Microsoft 365 environment.
We never access:
Emails
Documents and files
Calendars
Teams or chat messages
Audit logs
Any other user-generated content
All permissions are visible in your Azure portal under Enterprise Applications, where you can review or revoke OneDirectory's access at any time.
Access control and roles
OneDirectory uses role-based access control with three role types: administrators, directory editors, and end users. What each person can see and do is determined by their role. The application API is accessible only over TLS 1.2+, requires a valid OneDirectory user, and every request is ring-fenced to the organisation the user is signed into.
Availability, backups and disaster recovery
Availability is monitored continuously, and product updates are designed to be seamless with no downtime.
Backups are automated, encrypted, and geo-redundant, stored separately from production and replicated across regions.
Azure stores data three times in the primary region, with geo-redundant copies replicated to a paired region.
A formal Business Continuity and Disaster Recovery programme is in place, designed for rapid recovery.
Application and operational security
Development follows a formal Secure Development Lifecycle (SDLC) with change management, separation of duties, secure-coding standards, and automated and manual testing.
Development, testing, and staging are fully separated from production. No production customer data is used in development or testing.
Privileged access to production is tightly restricted, MFA-enforced, logged, and reviewed quarterly.
No external parties have access to production data. Approved vendors are used only for cloud infrastructure and business operations, under due diligence and ongoing monitoring.
All employees are bound by security obligations and confidentiality and non-disclosure agreements.
Our track record
Since launching in 2011, OneDirectory has had no history of any security breach affecting customer data, and maintains a formal Incident Response Plan for rapid detection, escalation, and resolution. As a Microsoft Certified Partner and ISV, OneDirectory benefits from Microsoft's ongoing investment in securing the Azure platform.
Need a deeper review? Security teams can request our full Security Overview, Data Protection Addendum (DPA), and policy documents under NDA by emailing security@onedirectory.com. |