ISAE 3402 Type 2
MyDesk is subject to an ISAE 3402 Type 2 audit, which is carried out annually by an independent auditor. The statement covers our control environment and security processes and is available to customers under NDA.
ISAE 3402 Type 2 is an internationally recognized standard for service organizations' internal controls. The Type 2 declaration not only confirms that the controls have been designed correctly (Type 1), but that they have also operated effectively over a period of time.
GDPR and data processing agreement
MyDesk enters into a data processing agreement (DPA) with all customers as standard. The agreement is drawn up in accordance with GDPR article 28 and contains all legally required elements, including:
- Purpose and scope of the processing
- Instructional authority and limitations
- Safety measures and technical requirements
- Sub-processors and disclosure
- Assistance with data subject's rights
- Deletion and return of data
- Audit and documentation
NIS2 statement
MyDesk has prepared an NIS2 statement that documents our approach to cyber security in accordance with the requirements of the NIS2 directive. The statement is available on request and covers risk assessment, incident management, supply chain security and technical safeguards.
Access to documentation
Customers and potential customers can request access to our compliance documentation via our Security Team. Documentation is typically provided under NDA and includes ISAE 3402 statement, DPA and NIS2 statement.
Compliance overview
- ISAE 3402 Type 2 – Annual revision
- GDPR DPA – Standard for all customers
- NIS2 statement – Available on request
- External auditor – Independent control
- Audit log – Documented control environment
- Encryption – TLS + encryption at rest