Security & Compliance

Your data stays in your tenant.

DC Workflow is built on Microsoft Azure and runs entirely within your Microsoft 365 environment. Documents and review data are stored in your own SharePoint and never transmitted to or stored by DC Workflow infrastructure.

Tenant isolation

Every organisation's data is siloed to its own Microsoft 365 tenant. There is no shared storage. No DC Workflow employee can access your documents.

Azure AD on every request

Every API request is authenticated against Azure AD. No service-level shared credentials. All access flows through your existing Conditional Access and MFA policies.

Audit logging

Document uploads, reviewer assignments, approvals, and transmittal generation are all logged with user identity, timestamp, and IP address.

Admin-controlled access

Deployed through Teams Admin Center. IT controls who has access, which SharePoint sites are in scope, and which Graph API permissions are granted, without end-user intervention.

1 Infrastructure & data handling

Technical controls
Document storage
All documents are stored in your organisation's SharePoint Online document libraries via Microsoft Graph API. DC Workflow never copies, caches, or retains document content on its own servers.
Data residency
DC Workflow's application layer is hosted on Azure Australia East. Document data residency is determined by your Microsoft 365 tenant's own data residency configuration, typically the region selected during tenant creation.
Encryption in transit
TLS 1.2 minimum on all connections. TLS 1.0 and 1.1 are disabled. Certificate pinning enforced for Microsoft Graph API calls.
Encryption at rest
AES-256 via Microsoft's platform encryption for SharePoint Online. DC Workflow does not manage encryption keys — Microsoft does, under your tenant's key management policy.
Metadata retention
Review records (reviewer names, dates, transmittal references) are retained for 7 years to support engineering audit and certification requirements. This data does not include document content.
Data deletion
Upon subscription termination, all review metadata is deleted within 30 days. Document data remains in your SharePoint and is subject only to your own retention policies.

2 Microsoft Graph API permissions

DC Workflow requests the minimum Graph API permissions it needs to work. All permissions require explicit administrator consent before any user can authorise the application.

Permission scopeWhy it is neededType
openid, profile, email
Identifies the signed-in user for display and audit logging. No personal data is stored beyond what is already in your Azure AD.
Delegated
User.Read
Reads the signed-in user's profile (display name, email). Used to populate the "Submitted by" field on transmittal records.
Delegated
Files.ReadWrite
Reads and writes files in the user's OneDrive for Business. Used to store review documents uploaded by the current user.
Delegated
Sites.ReadWrite.All
Reads and writes to SharePoint document libraries. Required to store controlled documents in organisation-wide project libraries rather than personal OneDrive.
App
Mail.Send
Sends transmittal and review assignment notifications to reviewers on behalf of the submitting user. No email is read.
Delegated

DC Workflow does not request permissions to read email inboxes, access calendars, manage users, or access Teams messages. The full permission list is declared in the app manifest and reviewed during Teams Admin Center approval.

3 Access controls & identity

Identity and access management
Authentication
Azure Active Directory (Entra ID) only. DC Workflow does not maintain its own user database or credential store. All authentication uses Microsoft's identity platform.
Multi-factor authentication
DC Workflow enforces no MFA policy of its own; it delegates entirely to your Azure AD Conditional Access policies. If MFA is required by your tenant, it applies to DC Workflow automatically.
Conditional Access
Fully compatible. DC Workflow does not require any Conditional Access exclusions. Compliant device, MFA, IP restriction, and session control policies all apply as configured in your tenant.
Single sign-on
SSO is provided via Microsoft Teams SDK silent authentication. Users authenticated to Teams are automatically signed in to DC Workflow without additional prompts.
Session management
Sessions are governed by Microsoft's token lifetime policies. DC Workflow does not issue or store its own session tokens.
Access revocation
Access can be revoked immediately by removing the DC Workflow enterprise application from your Azure AD tenant, or by revoking user tokens via the Azure Portal or Graph API.

4 Compliance & certifications

Standards and frameworks
GDPR
DC Workflow operates as a data processor under GDPR where it processes personal data on behalf of your organisation. A Data Processing Agreement (DPA) is available. Contact privacy@dcworkflow.com.
Australian Privacy Act 1988
Piksort Pty Ltd (DC Workflow's operator) is incorporated in Western Australia and complies with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth).
Microsoft 365 compliance
DC Workflow inherits the compliance posture of your Microsoft 365 tenant. Microsoft holds ISO 27001, SOC 2 Type II, and other certifications for the underlying platform. See Microsoft compliance offerings.
Penetration testing
External penetration tests are conducted annually. An executive summary is available to enterprise customers under NDA. Contact enterprise@dcworkflow.com.
Vendor security questionnaire
Pre-completed VSQ responses covering access controls, data handling, incident response, and business continuity are available on request for procurement and IT security reviews.

Responsible disclosure

Found a security vulnerability? Please report it to security@dcworkflow.com before any public disclosure. We acknowledge all credible reports within 24 hours and work to remediate verified vulnerabilities as a priority. We do not pursue legal action against good-faith security researchers.

Need a security review package?

Contact enterprise@dcworkflow.com to request the full security documentation pack: the DPA, pen test summary, VSQ responses, and Azure AD integration guide.