15.1 Information security in supplier relationships
Objective : To ensure protection of the organization's assets that is accessible by suppliers
15.1.1 Information security policy for supplier relationships
There are only three providers of 365Talents with access to the data of the Service belonging to the Clients :
- The hosting provider : Microsoft Azure
- The transactional emails provider : Mailjet
- The integration aggregator: Kombo
For its hosting provider, 365Talents has selected a well-known provider with very high security and quality standards.
Other providers doesn't have access to personal data or data belonging to the Clients. Information to which each provider has access to are identified in this page.
365Talents always ensure that any communication of data with a provider is limited to the strict minimum and that communications are performed through secure means (e.g. over an HTTPs connection compliant with 10 - Cryptography and 13 - Communications security)
15.1.2 Addressing security within supplier agreements
Information security requirements for mitigating the risks associated with hosting provider access to the 365Talents' assets are agreed and documented through a dedicated contract.
The hosting provider Microsoft Azure of 365Talents is certified ISO 27001:2013, ISO 270017:2015, ISO27018:2019, ISO27701:2019 and provides SOC1 type II and SOCoc2 type II reports, reviewed by 365Talents, to demonstrate its commitment to address security as agreed.
Information security requirements to mitigate risks associated with the integration aggregation provider's access to 365Talents' assets are agreed and documented as part of a dedicated contract. Integration aggregation provider Kombo is ISO 27001:2017 certified and provides a SOC2 type II report reviewed by 365Talents to demonstrate its commitment to addressing security as agreed.
For the other providers, information security management by these providers is documented in their "Terms of Use" (e.g. transactional emails provider). Transactional email provider Mailjet is ISO 27001:2013 certified to demonstrate its commitment to handling security as agreed.
15.1.3 Information and communication technology supply chain
The hosting provider of 365Talents propagate agreed security requirements to its whole supply chain.
15.2 Supplier service delivery management
Objective : To maintain an agreed level of information security and service delivery in line with supplier agreements
15.2.1 Monitoring and review of supplier services
365Talents review annually the SOC2 type II reports published by its hosting provider to identify potential change that may raise risks for 365Talents and its Clients.
365Talents verify annually that the ISO27001 certification of its transactional email provider is still valid.
365Talents annually reviews SOC2 Type II reports and ensures that its integration aggregation provider's ISO27001 certification is maintained, in order to identify potential changes that could result in risks for 365Talents and its Customers.
15.2.2 Managing changes to supplier services
365Talents review the SOC2 type II reports published by its hosting provider to identify potential change that may raise risks for 365Talents and its Clients.
365Talents annually reviews its integration aggregation provider's SOC2 Type II reports to identify potential changes that may pose risks to 365Talents and its Customers.