Security / trust page — Joan

Cited by

Facts read from this source

• ISO 27001 Report an error

  “Visionect d.o.o., the company behind Joan, holds ISO/IEC 27001:2022 certification.”

• Company name Report an error

  “Visionect d.o.o., the company behind Joan, holds ISO/IEC 27001:2022 certification.”

• Data center region Report an error

  “All customer data is hosted in EU-based data centers on Google Cloud Platform and encrypted end-to-end.”

• Security contact email Report an error

  “WRITE TO SECURITY@GETJOAN.COM”

• ISO certificate download Report an error

  “DOWNLOAD ISO CERTIFICATE”

• ISO surveillance reviews Report an error

  “Independently audited ISMS. Annual surveillance reviews.”

• Data location belgium Report an error

  “Data hosted in Belgium on Google Cloud. Encrypted in transit (TLS 1.3) and at rest. No data leaves the European Union.”

• SSO Report an error

  “Single Sign-On via OAuth2, Google, and Microsoft 365.”

• SCIM provisioning Report an error

  “SCIMv2-compatible identity providers for centralized user provisioning and deprovisioning.”

• Rbac Report an error

  “Role-based access control (RBAC) lets administrators manage permissions per role.”

• Tx ramp level 1 Report an error

  “The Joan cloud service is certified under the Texas Risk and Authorization Management Program (TX-RAMP) at Level 1, so Texas state agencies and public institutions can procure Joan.”

• Device memory only storage Report an error

  “Joan devices hold calendar data in memory only. No data is written to disk, and all event details are cleared on reboot.”

• Calendar sync window Report an error

  “Joan syncs room calendar events for the next three months and stores them on Joan’s secure, EU-based servers.”

• Calendar integrations Report an error

  “This applies to every calendar integration: Google Workspace, Microsoft 365, Exchange and iCal.”

• Calendar retention Report an error

  “Calendar data is kept for as long as your organization uses Joan, and you can request complete deletion of your calendar data at any time.”

• Stored event fields Report an error

  “Stored data includes event details and the organizer’s and attendees’ names, email addresses and response status.”

• Least privilege access Report an error

  “Team members access only the data required for their role. Access is reviewed periodically.”

• Employee security training Report an error

  “All staff complete security awareness training at onboarding and receive ongoing education.”

• Code review policy Report an error

  “All code changes undergo peer review before production deployment. Automated testing is integrated into the CI/CD pipeline.”

• Vulnerability management Report an error

  “Regular vulnerability assessments, prioritized by risk severity and aligned with ISO 27001.”

• Incident response GDPR Report an error

  “Documented plan covering detection, containment, recovery, and post-incident review. Customers notified per GDPR obligations.”

Scores citing this record

• The Microsoft 365 Administrator Integrations, identity & administration
• The Microsoft 365 Administrator European sovereignty
• The Office Manager Occupancy analytics & employee privacy
• The Office Manager Integrations, identity & administration
• The Office Manager European sovereignty
• The People Lead Occupancy analytics & employee privacy
• The People Lead Integrations, identity & administration
• The People Lead European sovereignty
• The Skeptic Integrations, identity & administration
• The Skeptic European sovereignty
• The Workplace Manager Occupancy analytics & employee privacy
• The Workplace Manager Integrations, identity & administration
• The Workplace Manager European sovereignty
• The Works Council Member Integrations, identity & administration
• The Works Council Member European sovereignty