Hosting and infrastructure
Where is MyDesk hosted?
MyDesk is delivered as a cloud-based SaaS solution in Microsoft Azure. Data is processed and stored within the EU/EEA, and the documentation describes Microsoft Ireland Operations as an approved sub-processor for hosting applications and databases.
Is MyDesk a SaaS solution?
Yes. MyDesk is delivered as a fully cloud-based SaaS solution without on-premise components as a prerequisite for the normal delivery.
How are production and testing separated?
Production and testing take place in separate environments. If production data is exceptionally used in tests, it is described that the test environment must be subject to corresponding data protection obligations.
What are your recovery goals?
In reviewed SLA material, RPO and RTO are stated to be up to 24 hours. Final goals follow the specific customer agreement and service setup.
Do you have a break-glass procedure?
Yes. MyDesk describes a documented break-glass procedure in the event of an identity or access breach, so that critical access can be restored in a controlled manner in emergency situations.
Identity and access management
Does MyDesk support Microsoft Entra ID?
Yes. MyDesk supports Microsoft Entra ID as central identity and access management and can use Single Sign-On via Entra ID.
Does MyDesk support SSO and MFA?
Yes. Single Sign-On is supported via Microsoft Entra ID, and MFA can be enforced via customer identity policies. MyDesk also supports passwordless scenarios when configured in Entra ID.
What authentication protocols does MyDesk use?
MyDesk describes using OpenID Connect and OAuth 2.0 as central authentication mechanisms. In individual customer requirements, SAML 2.0 is also accepted as an alternative, where relevant.
Do you use shared accounts?
No. MyDesk describes that no shared user accounts are used and that access is based on unique identities so that administrative actions can be tracked.
How are access rights handled?
MyDesk supports role-based access management and the least privilege principle. Administrative changes and access rights are periodically reviewed and included in the audit trail.
Can MyDesk enforce Conditional Access?
MyDesk supports the customer's Conditional Access policies through integration with Microsoft Entra ID, including policies for location, device compliance, risk and MFA.
Data protection and encryption
Is the data encrypted?
Yes. MyDesk describes encryption of data in transit and at rest as part of the security design, with TLS in transit and Azure standards for encryption at rest.
What personal data does MyDesk typically process?
It depends on the activated modules, but the material typically describes general user information such as name and email address as well as data related to booking, guest registration and meeting management.
Does MyDesk enter into a data processing agreement?
Yes. MyDesk enters into a data processing agreement with customers and supports GDPR-related requirements, including articles 28, 32 and 33.
Compliance and documentation
Can customers get documentation for your security work?
Yes. On request, MyDesk can provide relevant documentation, for example DPA, NIS2 statement, ISAE 3402 statement and relevant statements for incident response and vulnerability management.
Does MyDesk have an ISAE 3402 declaration?
Yes. MyDesk refers to an updated ISAE 3402 Type 2 declaration with annual revision.
Is MyDesk ISO 27001 certified?
The reviewed material describes compliance with principles and recommendations in ISO 27001. If a specific certification status is desired, it should be stated separately on the page or upon request.
Can customers audit MyDesk?
Yes. The material describes the possibility of documentation, audit statements and, in certain cases, additional audits or inspections according to the basis of the agreement.
Security incidents and monitoring
How does MyDesk handle security incidents?
MyDesk has a documented incident response process with monitoring, triage, escalation, remediation, customer communication and final evaluation. There are defined roles for coordination, engineering, support and management.
When are customers informed of a security incident?
In the NIS2 statement, MyDesk describes an early warning model with notification no later than 24 hours after knowledge of an incident, status update within 48 hours and final report typically within a month. Agreement-specific deadlines may be stricter.
How does MyDesk work with vulnerabilities?
MyDesk describes continuous vulnerability monitoring via, among other things, Microsoft's security bulletins, automatic scans in Azure and notifications from suppliers. Critical vulnerabilities are dealt with as a matter of priority.
Do you keep logs of administrative actions?
Yes. Administrative actions, rights changes and configuration changes are audit-logged and can be used for traceability and follow-up.
How long are logs kept?
MyDesk states that log data is stored for a minimum of 30 days in the MyDesk environment.
Can logs be exported to the customer's SIEM?
Yes. MyDesk describes the possibility of exporting operational and security logs to the customer's SIEM, including Microsoft Sentinel, in relevant deliveries.
Backup and recovery
How does MyDesk handle backups?
MyDesk describes a minimum daily backup and retention of a minimum of 30 days. In more recent material, reference is also made to Azure Backup and Azure SQL point-in-time restore with a minimum retention of 35 days.
Integrations and application security
Does MyDesk support Microsoft Graph?
Yes. MyDesk integrates with Microsoft 365 and Exchange Online via documented Microsoft Graph APIs and least-privilege delegated permissions.
Does the integration require global administrator rights?
MyDesk describes that the solution should not require global administrator rights as a permanent operating model. However, in certain onboarding scenarios, an initial approval in the customer's tenant may be required.
Can MyDesk be used together with Outlook?
Yes. The material describes access via Outlook for web and desktop as well as Microsoft 365 integration. In relevant deliveries, mobile access and near real-time synchronization are also supported.
How is customer separation ensured?
MyDesk describes logical isolation between customers so that data, configuration and access rights are not shared across.
Sub-processors and customer responsibility
Who is your central sub-data processor?
In the reviewed material, Microsoft Ireland Operations appears as an approved sub-data processor for hosting applications and databases.
How are changes in sub-processors notified?
The data processor agreements describe a notice of at least one month for planned changes, so that the customer can object before the change takes effect.
What is the customer's own responsibility?
Among other things, the customer is responsible for correct user administration, own identity policies, correct master data, local processes and the part of the infrastructure or the third-party ecosystem that lies outside MyDesk's direct operational responsibility.
Which channels are used for security questions or incidents?
MyDesk uses support@mydesk.io and telephone +45 5191 4488 as security and incident channels during normal working hours (weekdays 08.00–17.00 Danish time). Extended P1 support can be arranged depending on the customer's service setup.