Trust
What is true today, in writing
Most trust pages are a wall of logos. This one is two columns: the controls our code and our paperwork actually back, and the ones we have not built yet. We would rather you find the second column here than in month three.
Last reviewed September 28, 2026
True today
Backed by code, a contract, or a public record
The AI provider is named by feature
The provider catalog documents Qwen through Vercel AI Gateway for website generation/refinement and video planning/editorial processing, with zero-data-retention-capable routing required. Google Gemini handles the storefront assistant, logo prompts, and content tools. Higgsfield/Seedance handles video visuals; Azure provides narration, rendering, and private media storage. Saved website projects live in the United States Firebase database and private video drafts in United States Azure storage; provider processing networks are not represented as US-only. These documented routes do not establish verified live API availability.
Provider identities and processing roles are listed on /trust/subprocessors; website routing and retention requirements are enforced in server code.
Private account data and paid access have separate controls
Firestore rules deny client access unless a rule permits it. Private account records are scoped to the signed-in customer; content you choose to publish, such as a QR destination or link page, is intentionally public. Payment entitlements are updated by server-side billing handlers, not by browser-supplied plan fields.
Enforced in firestore.rules, deployed with the application.
Microsoft 365 content and operational records have different homes
Your mail and files remain in your Microsoft 365 tenant. Configured automations process them through Microsoft Graph with your administrator's consent. We also keep extracted operational details, run history, and usage records in our own Azure PostgreSQL database. Those records can contain personal data; they are not the same as keeping every record only in your tenant.
The Privacy Policy and its managed-services addendum explain the data categories, providers, retention, and deletion process.
A named business with published support contacts
IMPRESSIONSDIRECT360 LLC is a Missouri limited liability company. Our business mailing address is 701 Market St Ste 110 PMB2008, Saint Louis, MO 63101; it is a private mailbox, not a walk-in office. Reach support through the phone number or email below during published business hours.
+1 (314) 339-4936 · support@impressionsdirect360.com · Monday–Friday, 9:00 AM – 6:00 PM Central
Stripe handles card data — we never see it
Card details are entered into Stripe's hosted payment controls rather than our application servers. Our billing records contain transaction and subscription details, provider identifiers, and limited payment-method details such as card brand and last four digits.
Supported domain registrations and their selected Domain Guard or Recovery Vault add-ons use one ID360 Stripe Checkout and server-side payment events. OpenSRS fulfills domain registration and renewal, while transfer and registrar-setting requests are reviewed through ID360 support. Payment confirmation alone is not proof that a domain has been registered.
Customer activity is visible, with partial coverage
The account audit screen shows recorded mailbox creation and removal. The Microsoft 365 dashboard shows managed automation activity. These views do not yet form a complete audit trail for every campaign, team, or billing change.
Sign in to see records belonging to your account. Each screen explains its scope; a missing event is not proof that no action occurred.
On the roadmap
Decided, not delivered — do not buy on these
A formal third-party audit
We have not been audited by anyone, and we hold no security certification. When we engage an auditor we will say who, for what scope, and when the report is expected — and we will not describe the engagement as a certification until a report exists.
Not started.
Measured ID360 uptime history
Our public /status page already shows OpenSRS provider status and planned maintenance. It does not yet publish automatically measured uptime or per-service response times for ID360. That measurement history remains planned: an upstream provider feed is not proof that every ID360 customer journey is working.
Provider notices are available now. ID360 automation uptime targets are not a contractual uptime guarantee.
A complete cross-product audit trail
Mailbox and managed automation activity have customer-facing views today. A single, comprehensive history covering campaign, team, billing, and other account changes is still planned. Contact support when you need help investigating an event outside the available views.
Partial activity views are available; complete cross-product coverage is not.
Tooling around the Microsoft access you grant
Today your Microsoft 365 admin consents to a named ID360 application from inside your own admin center. Its permissions are tenant-wide, not confined to the mailboxes and sites you nominate; pointing the automations at only those is our configuration choice, not a boundary Microsoft enforces. Consent has no built-in expiry date and you can withdraw it yourself. Blocking the application prevents new access tokens, but existing tokens may remain valid until they expire. Contact our operators through /support to suspend jobs and confirm access has stopped; we do not guarantee an instant cutoff. A reseller relationship does not itself grant granular delegated admin (GDAP) access. Our management integration uses the application consent described here. We have not built software that manages, reviews, or reports on those relationships; Microsoft's admin center is the system of record, and yours to control.
A working practice, not a product feature.
What we do not claim
We hold no security certifications
If a control below matters to your purchase, we are not the right fit today and we will tell you that on the first call rather than in a procurement questionnaire six weeks later.
- SOC 2 (Type I or Type II)
- ISO 27001 or any ISO certification
- HIPAA compliance or a signed BAA
- PCI DSS certification of our own systems
- Any Microsoft Solutions Partner designation
The detail behind each of these
Subprocessors
Every vendor that can touch customer data, what they do, what reaches them, and where they process it.
View the listIncident response
How to reach us, what we do in the first hours, and what we commit to telling you.
Read the commitmentMicrosoft 365 security
Graph scopes, the access you consent to and how you revoke it, tenant isolation, and where each kind of data lives.
See the Microsoft detailHave a security question we have not answered?
Send it over. If the answer is “not yet”, that is the answer you will get.