CyberCoach is a cyber security awareness service that provides training and advice to your people on related matters. It is implemented with Microsoft Bot Framework on the Azure cloud computing platform. We collect as little data about your organization and people as possible to provide the service.
What is the hosting environment or service model used to run your app?
Paas
Which hosting cloud providers does the app use?
Azure
Customer support contact.
humans@cultsecurity.com
Questions
Questions or updates to any of the information you see here? Contact us!
How the app handles data
This information has been provided by Cult Security about how this app collects and stores organizational data and the control that your organization will have over the data the app collects.
Information
Response
Does the app or underlying infrastructure process any data relating to a Microsoft customer or their device?
Yes
What data is processed by your app?
User profile data, User email address and external id.
Does the app support TLS 1.1 or higher?
Yes
Does the app or underlying infrastructure store any Microsoft customer data?
No
Questions
Questions or updates to any of the information you see here? Contact us!
Does the app perform automated decision making, including profiling that could have a legal effect or similar impact?
No
Does the app process customer data for a secondary purpose not described in the privacy notice (i.e. marketing, analytics)?
No
Do you process special categories of sensitive data (i.e. racial or ethnic origin, political opinion, religious or philosophical beliefs, genetic or biometric data, health data) or categories of data subject to breach notification laws?
No
Does the app collect or process data from minors (i.e., individuals under the age of 16)?
No
Does the app have capabilities to delete an individual's personal data upon request?
Yes
Does the app have capabilities to restrict or limit the processing of an individual's personal data upon request?
N/A
Does the app provide individuals the ability to correct or update their personal data?
N/A
Are regular data security and privacy reviews performed (for example, Data Protection Impact Assessments or privacy risk assessments) to identify risks related to the processing of personal data for the app?
Yes
Questions
Questions or updates to any of the information you see here? Contact us!
Information
Response
Does your application integrate with Microsoft identity platform (Microsoft Entra ID) for single-sign on, API access, etc.?
Yes
Have you reviewed and complied with all applicable best practices outlined in the Microsoft identity platform integration checklist?
Yes
Does your app use the latest version of MSAL (Microsoft Authentication Library) or Microsoft Identity Web for authentication?
Yes
Does your app support Conditional Access policies?
No
Does your app support Continuous Access Evaluation (CAE)
N/A
Does your app store any credentials in code?
No
Apps and add-ins for Microsoft 365 might use additional Microsoft APIs outside of Microsoft Graph. Does your app or add-in use additional Microsoft APIs?
No
Data access using Microsoft Graph
Graph Permission
Permission Type
Justification
Microsoft Entra App ID
GroupMember.Read.All
delegated
Gives additional information about AD groups. In CyberCoach it is used to fetch the names of AD groups and visualize them in a dropdown which can be used to filter data. The group names are fetched on demand and never stored.
Gives access to additional information about the current user which is not included in the profile scope. CyberCoach requires this scope to be able to access the AD groups a user belongs to. This information is used for statistics on the Admin Panel. CyberCoach only fetches and stores the object ID of the group.
Allows CyberCoach retrieve data about other users. The other user scopes mentioned above only gives access of the currently logged in user. When generating a report of who has completed which training this permission is required. This enables transforming user object IDs to names. The names are only outputted into the report and never stored
This module equips learners with the knowledge and skills necessary to implement a robust Zero Trust security framework for their Microsoft 365 Copilot deployments.
Demonstreert de basisprincipes van gegevensbeveiliging, levenscyclusbeheer, informatiebeveiliging en naleving om een Microsoft 365-implementatie te beschermen.
