Security and compliance

This article describes how Cloudiway, built on Windows Azure, provides a secure environment for your migrations and identity management.

Windows Azure secure environment

Microsoft’s public auditor Deloitte has issued a Service Organization Control (SOC) 2 Type 2 report for Windows Azure in security, availability, and confidentiality trust principles:

Security and compliance

Cloudiway leverages Windows Azure certifications and attestations to provide assurance to our customers regarding the security of the infrastructure, network, and physical security layers of Cloudiway’s cloud.

  • Security: Physical and logical protection against unauthorized access.
  • Availability: The system is operationally available for use as committed or agreed.
  • Processing integrity: System processing is complete, accurate, timely, and authorized.
  • Confidentiality: All information is classified and protected as committed or agreed.
  • Privacy: Personal information is collected, used, retained, and transferred as committed or agreed.
  • Data Processing Addendum (“DPA”), available online (click here), when the GDPR applies to the use by Customer of the Services to process Customer Data (as defined in the DPA).

Physical Security

The entire environment is hosted in Windows Azure which follows SOX recommendations to physically secure access to the datacenters.

USA customers: EastUS data center
Other regions: NorthEurope data center
For more information, please contact us.

Customer Segregation

By default, since Cloudiway platform is a SaaS application, the platform is shared between customers.

However, each customer project is logically separated and given its own Azure SQL database. Cloudiway is able to provide a dedicated environment to customers who require dedicated environments.

Systems access controls

  • Access to the platform is protected by a login-name/password combination.
  • Passwords are hashed in a non-reversible way using the SHA-256 algorithm and are not stored on our internal system.
  • Once logged in, customers have access only to their set of information.

Patch antivirus scanning

  • Up-to-date antivirus software is installed in every computer.
  • Servers are automatically patched by Microsoft in Windows Azure.

Data encryption

Customer data are encrypted using the AES-256 algorithm.

Azure SQL databases use default Transparent Data Encryption for all data at rest.


Communication between client browsers and Cloudiway servers takes place over SSL.
Migration data and IAM data are exchanged over SSL between the cloud providers (ie Google Apps, Office 365, Sales Force, etc…) and the Cloudiway servers.

Data destruction

Confidential customer information is never stored outside of the Windows Azure infrastructure and is automatically destroyed after 90 days of inactivity, or sooner if requested.


Cloudiway ensures that the appropriate level of logging is implemented at the application level, database level and operating system level, necessary for analysis and investigation in case of an incident or issue.

Logs are backed up daily and retained for 90 days.

In-depth security of the platform

Find out more

Cloud Migration Cloudiway
Want to try?
Cloud Migration Questions
Any questions?