Documented security
and compliance
MyDesk is subject to external audit and provides documentation for customers to conduct security reviews, due diligence and procurement processes.
ISAE 3402 Type 2
MyDesk is subject to an ISAE 3402 Type 2 audit conducted annually by an independent auditor. The statement covers our control environment and security processes and is available to customers under NDA.
ISAE 3402 Type 2 is an internationally recognized standard for service organizations' internal controls. The Type 2 statement not only confirms that the controls are designed correctly (Type 1), but also that they have operated effectively over a period of time.
GDPR and data processing agreement
MyDesk enters into a Data Processing Agreement (DPA) with all customers as standard. The agreement is designed in accordance with GDPR Article 28 and contains all legally required elements, including:
- Purpose and scope of the processing
- Instruction authority and limitations
- Safety measures and technical requirements
- Sub-processors and disclosure
- Assistance with data subject rights
- Deleting and returning data
- Audit and documentation
NIS2 statement
MyDesk has prepared a NIS2 statement documenting our approach to cyber security in accordance with the requirements of the NIS2 directive. The statement is available upon request and covers risk assessment, incident management, supply chain security and technical security measures.
Access to documentation
Customers and potential customers can request access to our compliance documentation via our Security Team. Documentation is typically provided under NDA and includes ISAE 3402 statement, DPA and NIS2 statement.
Compliance overview
- ISAE 3402 Type 2 - Annual audit
- GDPR DPA - Standard for all customers
- NIS2 statement - Available on request
- External auditor - Independent control
- Audit log - Documented control environment
- Encryption - TLS + encryption at rest
Compliance in practice
ISAE 3402 Type 2
Annual external audit of our control environment and security processes.
GDPR DPA
Data processing agreement as standard for all customers, designed according to GDPR art. 28.
NIS2 statement
Documented approach to cybersecurity in accordance with the NIS2 Directive.
Do you have any questions?
Contact our Security Team directly - we answer security, compliance and documentation questions quickly and accurately.
