Expense Tracker 365
Last updated by the developer on: August 27, 2024
General information
Information provided by Apps 365 & HR365 to Microsoft:
| Information | Response |
|---|---|
| App name | Expense Tracker 365 |
| ID | WA200007244 |
| Office 365 clients supported | SharePoint 2016 or later |
| Partner company name | Apps 365 & HR365 |
| Company's website | https://www.apps365.com |
| App's Terms of Use | https://www.apps365.com/end-user-license-agreement-eula/ |
| Core functionality of the app | Expense Tracker 365: Smart and modern way to monitor, categorize, and manage spending for employees. |
| Company headquarter location | India |
| App info page | https://www.apps365.com/expense-tracker-app-365/ |
| What is the hosting environment or service model used to run your app? | Paas |
| Which hosting cloud providers does the app use? | Azure |
| Customer support contact. | appsupport@apps365.com |
Questions
Questions or updates to any of the information you see here? Contact us!
How the app handles data
This information has been provided by Apps 365 & HR365 about how this app collects and stores organizational data and the control that your organization will have over the data the app collects.
| Information | Response |
|---|---|
| Does the app or underlying infrastructure process any data relating to a Microsoft customer or their device? | No |
| Does the app or underlying infrastructure store any Microsoft customer data? | No |
Questions
Questions or updates to any of the information you see here? Contact us!
Information from the Microsoft Cloud App Security catalog appears below.
| Information | Response |
|---|---|
| Do you perform annual penetration testing on the app? | Yes |
| Does the app have a documented disaster recovery plan, including a backup and restore strategy? | Yes |
| Does your environment use traditional anti-malware protection or application controls? | ApplicationControls, TraditionalAntiMalware |
| Do you have an established process for indentifying and risk ranking security vulnerabilities? | Yes |
| Do you have a policy that governs your service level agreement (SLA) for applying patches? | Yes |
| Do you carry out patch management activities according to your patching policy SLAs? | Yes |
| Does your enviroment have any unsupported operating systems or software? | No |
| Do you conduct quarterly vulnerability scanning on your app and the infastructure that supports it? | Yes |
| Do you have a firewall installed on your external network boundary? | Yes |
| Do you have an established change management process used to review and approve change requests before they are deployed to production? | Yes |
| Is an additional person reviewing and approving all code change requests submitted to production by the original developer? | Yes |
| Do secure coding practices take into account common vulnerability classes such as OWASP Top 10? | Yes |
| Multifactor Authentication (MFA) enabled for: | CodeRepositories, DNSManagement, Credential |
| Do you have an established process for provisioning, modification, and deletion of employee accounts? | Yes |
| Do you have Intrusion Detection and Prevention (IDPS) software deployed at the perimeter of the network boundary supporting your app? | Yes |
| Do you have event logging set up on all system components supporting your app? | Yes |
| Are all logs reviewed on a regular cadence by human or automated tooling to detect potential security events? | Yes |
| When a security event is detected are alerts automatically sent to an employee for triage? | Yes |
| Do you have a formal information security risk management process established? | Yes |
| Do you have a formal security incident response process documented and established? | Yes |
| Do you report app or service data breaches to supervisory authorities and individuals affected by the breach within 72 hours of detection? | Yes |
Questions
Questions or updates to any of the information you see here? Contact us!
| Information | Response |
|---|---|
| Does the app comply with the Health Insurance Portability and Accounting Act (HIPAA)? | No |
| Does the app comply with Health Information Trust Alliance, Common Security Framework (HITRUST CSF)? | No |
| Does the app comply with Service Organization Controls (SOC 1)? | N/A |
| Does the app comply with Service Organization Controls (SOC 2)? | No |
| Does the app comply with Service Organization Controls (SOC 3)? | No |
| Do you carry out annual PCI DSS assessments against the appand its supporting environment? | N/A |
| Is the app International Organization for Standardization (ISO 27001) certified? | No |
| Does the app comply with International Organization for Standardization (ISO 27018)? | N/A |
| Does the app comply with International Organization for Standardization (ISO 27017)? | N/A |
| Does the app comply with International Organization for Standardization (ISO 27002)? | N/A |
| Is the app Federal Risk and Authorization Management Program (FedRAMP) compliant? | No |
| Does the app comply with Family Educational Rights and Privacy Act (FERPA)? | N/A |
| Does the app comply with Children's Online Privacy Protection Act (COPPA)? | N/A |
| Does the app comply with Sarbanes-Oxley Act (SOX)? | N/A |
| Does the app comply with NIST 800-171? | N/A |
| Has the app been Cloud Security Alliance (CSA Star) certified? | No |
Questions
Questions or updates to any of the information you see here? Contact us!
| Information | Response |
|---|---|
| Do you have GDPR or other privacy or data protection requirements or obligations (such as CCPA)? | No |
Questions
Questions or updates to any of the information you see here? Contact us!
| Information | Response |
|---|---|
| Does your application integrate with Microsoft identity platform (Microsoft Entra ID) for single-sign on, API access, etc.? | Yes |
| Have you reviewed and complied with all applicable best practices outlined in the Microsoft identity platform integration checklist? | Yes |
| Does your app use the latest version of MSAL (Microsoft Authentication Library) or Microsoft Identity Web for authentication? | Yes |
| Does your app support Conditional Access policies? | Yes |
| List the types of policies supported | Policies are applied as per clients need and existing policies in their tenant. |
| Does your app support Continuous Access Evaluation (CAE) | N/A |
| Does your app store any credentials in code? | No |
| Apps and add-ins for Microsoft 365 might use additional Microsoft APIs outside of Microsoft Graph. Does your app or add-in use additional Microsoft APIs? | No |
This application does not use Microsoft Graph.
This application does not have Additional APIs.
Questions
Questions or updates to any of the information you see here? Contact us!
Certification information
| Control | Microsoft 365 Certification Result |
|---|---|
| APPLICATION SECURITY | N/A |
| Penetration Testing | N/A |
| Vulnerability Assessment Review (Penetration Test) | N/A |
| OPERATIONAL SECURITY | PASS |
| Awareness Training | In Scope |
| Malware Protection - Anti-Malware | N/A |
| Malware Protection - Application Control | N/A |
| Patch Management - Patching & Risk Ranking | N/A |
| Vulnerability Scanning | N/A |
| Network Security Controls (NSC) | N/A |
| Change Control | In Scope |
| Secure Software Development/Deployment | In Scope |
| Account Management | In Scope |
| Security Event Logging, Reviewing and Alerting | N/A |
| Information Security Risk Management | In Scope |
| Security Incident Response | In Scope |
| Business Continuity Plan (BCP) and Disaster Recovery Plan | In Scope |
| DATA HANDLING SECURITY & PRIVACY | PASS |
| Data in Transit | N/A |
| Data At Rest | N/A |
| Data Retention, Back-up and Disposal | N/A |
| Data Access Management | N/A |
| GDPR | N/A |
| HIPAA | N/A |
Questions
Questions or updates to any of the information you see here? Contact us!