Compliance

Overview

At eloomi, safeguarding your data within our systems stands as a fundamental commitment. Our policies governing personal internet and email usage, security protocols, software and hardware inventory, and data retention serve to fortify both eloomi and our valued customers. Endorsed by management, these policies are carefully communicated to our employees and external stakeholders. Regular reviews of our information security procedures ensure adaptability to significant changes while maintaining alignment with approved policies.

Every eloomi employee is mandated to comply fully with the ‘eloomi IT Security Policy,’ a core aspect of their employment contracts, reinforcing stringent confidentiality requirements. Our comprehensive compliance program includes ongoing IT Security Policy training, disaster recovery protocols, documented Standard Operating Procedures, and Audit Reports that rigorously adhere to ISAE 3000 standards.

eloomi’s ISAE 3000 audit report spans critical areas like Change Governance, IT Security, GDPR compliance, employee confidentiality, Access control management, IT-equipment usage, System operation, Backup protocols, and Malware and encryption, all rooted in the ISO 27001 framework.
To ensure compliance with our cloud infrastructure partner, Microsoft Azure, we actively acquire and assess their audit reports, conduct thorough supplier risk assessments, and engage in meticulous reviews. This stringent monitoring, a crucial part of our internal audit facilitated by Deloitte, guarantees alignment with our exacting standards.

Subprocessors

For all Customers who have entered into an agreement with eloomi, this communication-page serves to notify updates regarding the list of subprocessors utilized or potentially utilized to deliver our services. We commit to maintaining an updated list, ensuring customers are informed about the scope of sub-processing utilized.

As per the Data Processing Agreement (DPA), customers can object in writing to the processing of their personal data by any new subprocessor within ten (10) days following the list update. The objection must outline the customer’s legitimate reasons for objection. Should no objection occur within the specified timeframe, the new subprocessor(s) shall be deemed accepted.
Learn more about our subprocessors

Audits and Certifications

ISAE 3000

eloomi’s ISAE 3000 audit report cover, Change Governance, IT Security, GDPR, Confidentiality of employees, Access control handling, Use of IT-equipment, System operation, Backup procedures, Malware and encryption, are based on the ISO 27001 framewor

ISO 27001

Microsoft Azure’s compliance with ISO 27001 standard, is a strong foundation of Information Security principles and contain detailed documentation of IT policy and procedures.

ISAE 3402 SOC 1-3 reports Microsoft Azure

ISAE 3402 SOC2 Security demonstrates that good security practices are in place and operating effectively at Microsoft Azure.