Skip to content

Security & compliance

Trust, engineered in — not bolted on.

CloudOnBox is designed so that even a total compromise of a customer tenant — or of NewTurn — cannot destroy your protected data. Here is exactly how.

Immutability (Object Lock)

Protected copies are written with Object-Lock retention in Compliance mode. Retention can be extended but never shortened — no one can delete a copy before it expires, including a compromised global admin or NewTurn itself.

Encryption everywhere

Each object is encrypted client-side with a unique AES-256 data key, which is wrapped by a per-tenant key encryption key held in Azure Key Vault. Everything is TLS 1.2+ in transit. Enterprise plans can use HSM-backed keys.

Hard tenant isolation

Every tenant has its own storage sub-account and its own key. Metadata is separated by row-level security keyed to the validated token, and cross-tenant access is blocked by automated tests in our pipeline.

Least-privilege Graph access

CloudOnBox uses Sites.Selected — you grant access only to the specific sites and drives you choose. We hold no passwords and never see your users’ credentials.

Zero-knowledge control plane

File bytes are never written to disk on infrastructure NewTurn controls. They stream through memory, encrypted, on the way to your storage. Our control plane stores only metadata.

Accountability & four-eyes

Every action is captured in an append-only audit log. Sensitive operator actions require written justification and four-eyes approval, and are surfaced in the customer’s own audit trail.

Where your data lives — and doesn’t

A quick data-flow view. File content only ever exists in two places: your Microsoft 365 tenant, and the immutable storage region you chose. It streams between them, encrypted, through our engine — and is never persisted by NewTurn.

  1. 1 · Your Microsoft 365

    Files live and are edited here, exactly as today. Governed by your Entra ID, MFA and Conditional Access.

  2. 2 · CloudOnBox engine (Azure UAE North)

    Metadata only. Bytes stream through memory, encrypted with your keys. Nothing is written to disk.

  3. 3 · Your sovereign storage

    The immutable, Object-Locked copy in the region you chose. Your keys, your residency, no early deletion.

Compliance posture

Built toward the standards your auditors ask for.

UAE PDPLISO 27001SOC 2 Type II

CloudOnBox is designed for these frameworks; the control mapping, data-flow diagram, permission justification and DPA are available on request. We state certifications as achieved only once formally confirmed. Request a DPA.

Want the security pack?

We’ll walk your security team through the architecture, permissions and data-flow — and share the documentation.

Book a demo See how it works

One admin consent · nothing installed · restore in two clicks