The short version. Our products run inside your Microsoft tenant. We operate no service that stores your data, so most of the questions on a standard security questionnaire resolve to "not applicable, and here is why" rather than to a control we assert and you have to trust.
This page is the public summary. The full security and compliance review is available under NDA — email security@simplesmoothsafe.com.
1. Where your data actually is
| Product | Where it runs | What reaches us |
|---|---|---|
| SSS DocGen | A container in your Azure subscription, reading your Dataverse | Nothing. Documents return to the caller; unless Attach is used they are stored nowhere. |
| SSS DMS | Your Power Platform. Reads your Dataverse and your SharePoint in place | Nothing. It does not migrate, copy or move files. |
| PSA Hub | Your Dataverse, native tables, under your Entra ID | Nothing. The app is hosted and authenticated by the Power Platform. |
There is no SSS-operated database, no shared multi-tenant application, and no data-processing pipeline of ours between you and your records. Backup, retention, DLP and eDiscovery remain your tenant's, governed by policies you already run.
2. Identity and access
- Sign-in is the platform's. PSA Hub and SSS DMS authenticate through Entra ID as Power Apps surfaces. We plumb no tokens of our own and store no credentials for your users.
- Authorisation is your security roles. Access follows the Dataverse privileges and SharePoint permissions a user already has. Our products grant nobody anything they did not already have.
- DocGen's service identity is yours. One Entra app registration in your tenant, client-credentials, with a Dataverse application user whose role you control.
- We hold no standing access to your environments. Support access is granted by you, for a case, and ends with it.
3. Secrets
The DocGen container reads its Entra client secret from Azure Key Vault through its own managed identity. It is never committed and never logged.
One limitation we publish rather than bury. The Dataverse plugin needs its own copy of that secret, and the out-of-the-box request it uses to read configuration — RetrieveEnvironmentVariableValue — cannot resolve Key Vault-backed environment variables. So on the Dataverse side the secret is a Text environment variable, readable by anyone who can read environment-variable values in that environment.
The compensating control is to restrict that privilege to the administrators who need it. The fix is known — have the plugin call RetrieveEnvironmentVariableSecretValue instead — and it is on the roadmap. It is stated on the product page, in the deployment runbook and here, because a security claim a product does not meet is worse than the limitation it papers over.
4. Sub-processors
Because no customer data flows to us in normal operation, the sub-processor list is short and covers only the systems that could touch material you deliberately send us — a support attachment, a log, an exported template.
| Sub-processor | Purpose | Location |
|---|---|---|
| Microsoft Ireland Operations Ltd | Email, file storage, Microsoft Forms | EU |
| Hosting provider | This website. Holds no customer data. | EU |
Website analytics (Plausible) is deliberately not on this list: it is cookieless, stores no personal data, and never touches customer data. It is covered by the Privacy Policy instead. Changes to this list carry 30 days' notice and a right to object — see the DPA, section 6.
5. Data protection
- You are the controller; we are a processor only in narrow, listed cases. Those cases — support access, diagnostic material you send, and scoped implementation work — are enumerated in the DPA, section 3.
- The DPA applies to every customer automatically, without having to be requested or negotiated. We will countersign yours if your process needs that.
- Transfers rely on the EU Standard Contractual Clauses (Decision 2021/914, Module Three) where a sub-processor's group could access data from outside the EEA.
- Breach notification within 48 hours of becoming aware, with what we know at the time rather than a delay until we know everything.
- Diagnostic material is deleted within 90 days of a case closing.
6. Development and change
- One codebase per product. No client forks — which means a security fix reaches every customer, rather than the subset whose branch someone remembered to patch.
- Managed-solution delivery. Standard Dataverse ALM. You import a signed managed solution through your own pipeline and your own approvals.
- Server-side enforcement. Rules that must not be bypassable live in Dataverse plugins, not in the front end. A client you can read is not a place to enforce a rate table.
- Tested. DocGen ships engine and integration coverage across the happy path and both verified statement variants.
- Platform compatibility maintenance is included for the life of a subscription — when Microsoft changes something underneath, fixing it is our problem.
7. What we do not claim
Stated plainly so nobody has to discover it in a questionnaire response:
- We hold no SOC 2 or ISO 27001 certification. We are a small company; those audits are not proportionate to an architecture that stores none of your data. If your procurement process requires a certified vendor, tell us early — it may be a genuine reason not to buy from us.
- We do not offer an uptime SLA, because we do not operate the environments the products run in. Availability is governed by your own agreements with Microsoft. Saying otherwise would be selling you a number we do not control.
- We do not run a paid bug bounty. We do answer reports ourselves, quickly, and we will not threaten a researcher acting in good faith — see security.txt.
- There is no 24/7 rota. Support is business hours with published response targets by severity; the Support & Service Levels document says exactly what that means.
8. Reporting a vulnerability
Email security@simplesmoothsafe.com, or see /.well-known/security.txt. We aim to acknowledge within two business days, tell you whether we can reproduce it within five, and agree a disclosure timeline with you rather than impose one.
Please do not test against a customer environment. If you need somewhere to test, ask and we will arrange it.
9. Questionnaires
Send it. We answer security questionnaires as part of a normal sales process, not as a favour, and we would rather answer yours than have you guess from this page. The full security and compliance review is available under NDA.