Service Trust Portal and Privacy Principles

What it is

Before an organisation puts data in a cloud service, it wants proof that the provider is trustworthy. Microsoft gives that proof in two ways. The Service Trust Portal is a website that publishes Microsoft's audit reports, certifications and compliance documents. The privacy principles are the promises that Microsoft makes about how it treats customer data.

How it works

The Service Trust Portal

The Service Trust Portal is Microsoft's home for compliance information about its cloud services, including Microsoft 365, Azure and Dynamics 365. Customers use it to answer questions from auditors and regulators about how Microsoft protects data.

It offers:

• Audit reports from independent auditors, for example SOC reports and ISO assessments.
• Certifications and attestations for standards and regulations such as ISO 27001, FedRAMP and others.
• Compliance guides and white papers that explain how Microsoft services support a given regulation, and how a customer can use them.
• Pen test and security assessment reports and similar documents.
• Industry and regional resources, such as documents for financial services or for a given country.

You sign in with a Microsoft account or a work account to view most of the documents, and you can save the ones you need to My Library, so that you are told when they are updated.

The Service Trust Portal helps with the customer's compliance work, but it does not make the customer compliant by itself. The customer still has to configure and operate its own part of the shared responsibility.

The six Microsoft privacy principles

Microsoft states six principles that guide how it handles data.

Using both together

An organisation that must show a regulator how its cloud provider is audited can download the audit report from the Service Trust Portal. An organisation that is worried about how its data is used can point to the privacy principles. Neither replaces the customer's own controls.

A worked scenario

A hospital plans to move its records system to a Microsoft cloud service. Its compliance officer signs in to the Service Trust Portal, downloads the latest ISO and SOC audit reports and a compliance guide for healthcare, and saves them in My Library. The privacy team reviews the six privacy principles, noting that Microsoft does not use customer content to target advertising. These documents go into the hospital's risk assessment, alongside its own controls for access and encryption.

Using the Service Trust Portal for an audit

1. Sign in to the Service Trust Portal with a Microsoft account.
2. Search for the audit report or certification that the auditor asks for, such as a SOC report or an ISO 27001 certificate.
3. Download it and save it to My Library, so that you hear about updates.
4. Read the compliance guide for your regulation, which explains how Microsoft services support it and what you must do yourself.
5. Keep the documents with your own evidence of how you configured and operate your services.

Standards you may see

Microsoft publishes evidence against many standards and regulations, including ISO 27001, SOC reports, FedRAMP and requirements for particular sectors such as health care and finance. The documents show what Microsoft has done. The customer still has to show what it has done.

Privacy principles in plain language

• Control: you choose how your data is collected and used.
• Transparency: Microsoft explains what it collects and why.
• Security: your data is protected by strong security and encryption.
• Strong legal protections: Microsoft respects local laws and treats privacy as a fundamental right.
• No content based targeting: your email, chat, files and other personal content are not used to target ads.
• Benefits to you: data collected is used to give you something of value.