Is Rencore Governance secure?
AI summary
Rencore GmbH holds ISO 27001:2022 and ISO 27017:2015 certifications, and Rencore Governance has a SOC 2 Type 2 report. Your data is hosted on Microsoft Azure, encrypted at rest and in transit with TLS 1.3, and protected by firewalls and restricted network access. The application undergoes annual external penetration testing, monthly code scans, and continuous monitoring. It uses Microsoft Entra ID, never stores passwords, does not use AI to process your data, and lets you revoke permissions.
Yes. Rencore Governance was built from the start with high security standards in mind, to meet the requirements of enterprise and government customers around the world.
Certifications
Rencore GmbH holds an ISO 27001:2022 and ISO 27017:2015 certification, and Rencore Governance has a SOC 2 Type 2 report. The certificates, audit reports, penetration test report and security policies are available on request: request access on trust.rencore.com. Read more in Certifications and compliance.
Infrastructure
Rencore Governance is hosted on Microsoft AzureMicrosoft AzureMicrosoft Azure is the Microsoft cloud platform for virtual machines, web apps and other cloud resources.Read more, in the data centerData centerThe data center is the Microsoft Azure region where Rencore Governance stores all data of a Workspace.Read more region you choose when you create your WorkspaceWorkspaceA Workspace is the top-level container in Rencore Governance. It holds the settings, users, roles and connected apps for exactly one Environment, the connected Microsoft 365 tenant.Read more. See Data Residency for the available regions.
Database
Rencore Governance stores data in Azure Storage Accounts and PostgreSQL. Both have built-in encryption, firewalls and restricted network access. Rencore follows secure development practices, including source code security scans, to protect against SQL injection.
Encryption
All information is encrypted. Azure Storage Accounts and PostgreSQL encrypt data at rest and in transit. All data in transit, including between the application and your browser, is encrypted with TLS 1.3.
Application
An external company runs a penetration test on Rencore Governance once a year. The report is available on request: request access on trust.rencore.com. The code is scanned for vulnerabilities at least once a month, and the production systems are monitored continuously.
AI features
Rencore Governance does not use AI features to deliver its own functionality. It governs AI services such as Microsoft 365 CopilotMicrosoft 365 CopilotMicrosoft 365 Copilot is the AI assistant in the Microsoft 365 apps. Rencore Governance covers it with the Copilot connector, part of the AI & Agents module.Read more, but no AI model inside the product processes your data.
Authentication
Rencore Governance uses Microsoft Entra IDMicrosoft Entra IDMicrosoft Entra ID, formerly Azure Active Directory, is the Microsoft identity service behind every Microsoft 365 tenant.Read more applications. Customers consent to these applications to grant Rencore Governance access to the data required to perform analysis and monitoring. Customers can revoke the App-Only or Delegated permissions granted to these applications at any time. Rencore never asks for or stores any usernames or passwords.
For more detail on the components and the measures that protect your data, read the Security Overview or contact our team.
Frequently asked questions
Which security certifications does Rencore hold?
Rencore GmbH holds ISO 27001:2022 and ISO 27017:2015 certifications, and Rencore Governance has a SOC 2 Type 2 report. Certificates, audit reports, the penetration test report and security policies are available on request at trust.rencore.com.
Where is my data hosted and how is it encrypted?
Rencore Governance is hosted on Microsoft Azure, in the data center region you choose when you create your Workspace. Azure Storage Accounts and PostgreSQL encrypt data at rest and in transit, and all data in transit is encrypted with TLS 1.3.
How often is Rencore Governance tested for vulnerabilities?
An external company runs a penetration test once a year. The code is scanned for vulnerabilities at least once a month, and the production systems are monitored continuously.
Does Rencore Governance store my usernames or passwords?
No. Rencore never asks for or stores any usernames or passwords. Rencore Governance uses Microsoft Entra ID applications that customers consent to, and customers can revoke the App-Only or Delegated permissions at any time.
Does Rencore Governance use AI models to process my data?
No. Rencore Governance does not use AI features to deliver its own functionality. It governs AI services such as Microsoft 365 Copilot, but no AI model inside the product processes your data.
Was this page helpful?
Thanks for the feedback.
Thanks. What was wrong?