18.1 Compliance with legal and contractual requirements
Objective : To avoid breaches of legal, statutory, regulatory or contractual obligations related to information security and of any security requirements.
18.1.1 Identification of applicable legislation and contractual requirements
365Talents has identified all legislation applicable to it, in particular GDPR.
365Talents follows its contractual requirements to ensure appropriate actions are performed to meet related requirements.
18.1.2 Intellectual property rights
365Talents only uses software legally acquired and in respect of the intellectual property, including when software are under an open licence (e.g. GPL or equivalent).
Softwares are acquired only through known and reputable sources.
Customers remain the sole owners and processors of all data, both data entrusted to 365Talents by the Customer and data collected by 365Talents on the Customer's instruction. 365Talents is the owner of all other Service data.
18.1.3 Protection of records
N/A
18.1.4 Privacy and protection of personally identifiable information
365Talents has identified regulations and laws applicable to privacy and personally identifiable information, in particular GDPR.
Related document is available here :
All the data of the service are hosted in European Union (Main datacenter in France, backup datacenter in Ireland).
18.1.5 Regulation of cryptographic controls
365Talents applies French and European laws and regulations regarding cryptographic controls.
All cryptographic controls used by 365Talents are based on internationally recognized standards and softwares.
18.2 Independent review of information security
Objective : To ensure that information security is implemented and operated in accordance with the organizational policies and procedures
18.2.1 Independent review of information security
The Service can be audited by the Client : The Client can send a written questionnaire to which 365Talents will answer.
The facilities of 365Talents where the Service is managed and maintained are accessible upon request to be audited.
365Talents carries out an annual SOC2 Type II audit, and can provide all supporting documents (report, letter of attestation) on request on our trust center.
365Talents implements internal controls to ensure compliance with IS security rules.
18.2.2 Compliance with security policies and standards
The Client can send a security audit questionnaire to which the hosting provider will answer. The hosting provider reserves the right to not answer to any question covered by industrial secret and for which the answer wouldn't be provided to any third-party.
The hosting provider of 365Talents doesn't allow any physical audit of its datacenters.
18.2.3 Technical compliance review
The Service is regularly audited and/or pen-tested by Clients of 365Talents.
Technical audits as well as penetration tests can be performed by the Clients as described in chapter 12.7.1 of 12 - Operations security
The last audit report from 2021 can be communicated to the Clients, upon request.