Accept the data processing agreement and get the security report

Under Security and data, the owner accepts the data processing agreement and anyone who manages settings downloads a Word report for an auditor; the public Trust page answers the rest.

In short

"Security and data" in an organization's settings holds two things. The data processing agreement says how {{brand}} handles personal data for the organization; its owner accepts it and each acceptance is kept. The security and data report is one Word file for an auditor or your own review.

Before you start

• Who: the organization's owner accepts the agreement. Anyone with "Change organization settings" sees the record and downloads the report.
• Plan: the report comes on every plan.
• First: the data processing agreement must be published; otherwise there is nothing to accept.

Steps

1. Open the organization's "Settings" › "Security and data".
2. Press "Read the data processing agreement" and read it.
3. Press "Accept version N" and confirm with "Accept".

1. On the same tab, press "Download report (Word)".

Result: "Data processing agreement accepted.", and "Every acceptance" lists the version, who and when.

What the report holds

• Two-step sign-in use, as counts only.
• The administrators.
• Every way in from outside: links, tokens and connections, by kind.
• Single sign-on, the audit log, where the data lives and how long it is kept - as it stands now, with a fingerprint of its facts.

The questionnaire, answered live

Access › Security log › "How we stand" shows the security figures and, under them, the questionnaire answers your own settings decide, read now: whether every member signs in with a second step, whether single sign-on is required, whether any member uses a password known from data breaches, whether tokens are limited and none lies unused, whether retention rules are set, whether the audit log streams to your own receiver, and whether everything is exported on a schedule.

• Each answer is Met, Partly or Open. Open answers come first.
• An answer that is not met links to where it is changed, such as "Set retention rules" or "Schedule an export".
• "Download the questionnaire" gives the full questionnaire, which also states what the product does for every organization.

How long the audit log stays online

Access › Security log › "How we stand" also says how long the audit log stays online. It keeps every line until you choose a number of years; older lines then move to archives you can download.

• A shorter time starts after seven days, so a slip can be put right. Keeping lines longer applies at once.
• Nothing moves while a legal hold stands.
• Reading the page takes "Read the audit and security logs". Changing it takes "Manage data retention and exports".

The public Trust page

The Trust page (/trust, linked in the site's footer) says where data lives and how it is protected. It also says how to get data out and delete it, who else handles it and how to report a vulnerability. "Security questionnaire" downloads standard answers as a Word document.

Good to know

• Only the organization's owner accepts the agreement; people who manage settings see the record.
• The report comes on every plan, so evidence of access controls is never paid for.
• Accepting a version twice records nothing new.

If something goes wrong

• "The agreement is not published yet, so there is nothing to accept."
• "Version N waits for the organization's owner to accept it." - ask the owner.

Related

• /help/organizations/activity-log
• /help/organizations/single-sign-on
• /help/settings/your-data-and-account