# Audiology Product Data Security - Auditdata > In order to ensure trustworthy relationships with customers and partners, Auditdata maintains and continuously improve its ISMS in accordance with the Auditdata Information Security Policy. Product Data Security # **Our Security** ***Commitment*** Auditdata serves healthcare organizations worldwide with medical device products and services. Handling sensitive personal data is part of that work, and our security practices reflect what that responsibility requires. ## **Information** **Security Management** System Auditdata maintains and continuously improves an Information Security Management System (ISMS) in accordance with the Auditdata Information Security Policy, supporting trustworthy relationships with customers and partners. The ISMS governs how information security is implemented, maintained, and improved across the organization. It is the mechanism through which organizational and technical security controls are operated and kept effective. The Auditdata ISMS is certified to **ISO/IEC 27001**, an international standard for information security management. Certification validates that Auditdata has implemented the controls defined in the standard, including the principles for initiating, implementing, maintaining, and improving information security management. ![DNV GL Logo2](https://www.auditdata.com/media/epmh2wzx/dnv-gl-logo2.svg) ## **Cloud Hosting** and Infrastructure Security Auditdata’s [Audiology Practice Management System](https://www.auditdata.com/ "Auditdata.com"), Manage™ is developed using the [Microsoft Azure technology](https://azure.microsoft.com/en-us "azure.microsoft.com") in accordance with the Auditdata product development processes compliant and certified with key industry standards such as ISO/IEC 27001 Information Security Management System and ISO/IEC 13485 Quality Management Systems for Medical Devices. Manage™ is operated by the Auditdata’s Cloud Operations unit included in the ISO 27001 certificate scope. Manage™ runs in the Microsoft Azure data centers managed and operated by [Microsoft Global Foundation Services](https://azure.microsoft.com/en-us?ocid=cloudplat_hp "azure.microsoft.com") (GFS). These geographically dispersed data centers also comply with key industry standards, such as ISO/IEC 27001, for security and reliability. They are managed, monitored, and administered by Microsoft operations staff that have years of experience in delivering the world’s largest online services with 24 x 7 continuity. In addition to datacenter, network, and personnel security practices, Windows Azure incorporates security practices at the application and platform layers to enhance security for application developers and service administrators. ![Azure](https://www.auditdata.com/media/1p5nupkt/artboard-1-2x.png) ## **Data Location** ## Microsoft Datacenters Microsoft datacenters are located within three major geographic regions: Asia, Europe and United States. The specific region is selected by the Auditdata Cloud Operations unit, based on the geographical location of the customer, to support compliance with national or regional data protection legislation. Microsoft will not transfer Customer Data outside the major geographic region(s) customer specifies (for example, from Europe to U.S. or from U.S. to Asia) except where necessary for Microsoft to provide customer support, troubleshoot the service, or comply with legal requirements; or where Auditdata’s Cloud Operations unit configures the account to enable such transfer of Customer Data. Auditdata does not control or limit the regions from which customers or their end users may access Customer Data. See the E.U. Data Protection Directive section below for information on the regulatory framework under which Auditdata transfers data. For detailed information on Microsoft Windows Azure location of customer data, please see Windows Azure Trust Center ## Customer Data and Other Data Types Customer Data is all the data, including all text, sound, software or image files that an Auditdata Customer provides, or is provided on the customers behalf, to Auditdata through your use of the Services. For example, Customer Data includes data that you upload for storage or processing in the Services. It does not include configuration or technical settings and information. Customer Data includes sensitive personal data. Strato is designed specifically for secure and safe handling of sensitive personal data, and meets legal requirements on encryption and secure handling of sensitive personal data during processing (transfer, in-memory and at rest). Administrator Data is the information about administrators (including account contact and subscription administrators) provided during sign-up, purchase, or administration of the Services, such as name, address, phone number, and e-mail address. Access Control Data is used to manage access to other types of data or functions within Service. It includes passwords, security certificates, and other authentication-related data. ## **Risk Assessment** Auditdata's choice of cloud provider is supported by a comprehensive Cloud Computing Service Provider Risk Assessment, carried out in accordance with the ENISA Cloud Computing Risk Assessment checklist from the European Union Agency for Cybersecurity. The assessment follows the recommendations of the Danish Data Protection Agency (Datatilsynet) for cloud-based processing of sensitive personal data. To support customers in evaluating the security of Manage, Auditdata has produced a white paper mapping the essential information security controls in Manage to the ISO 27001 controls. It gives customers detailed information on Auditdata's security policies and procedures, and is available on request at compliance@auditdata.com. For more on the compliance capabilities of Microsoft Azure, visit the Microsoft Trust Center.