Microsoft, Microsoft 365, Outlook, SharePoint, OneDrive, Microsoft Teams, Microsoft Graph, Azure, and Entra are trademarks of the Microsoft group of companies. ImpressionsDirect360 is an independent provider and is not affiliated with, sponsored by, or endorsed by Microsoft.
Most trust pages are a wall of logos. This one is two columns: the controls our code and our paperwork actually back, and the ones we have not built yet. We would rather you find the second column here than in month three.
Last reviewed August 22, 2026
Backed by code, a contract, or a public record
ID360 AI and the Studio's AI tools are built on Google's Gemini API. When you use one, the prompt content goes to Google for processing and the response comes back to you — Google is a US company and is listed on our subprocessor page rather than described vaguely. A second inference path for open-weight models exists in the codebase behind a hard-coded allowlist of US-hosted providers, but it is not what serves any feature today, and we would rather say so than let an allowlist imply something the live path does not do.
Google Gemini is listed on /trust/subprocessors; the unused allowlist is in lib/deepseek.ts.
Firestore rules start from deny-all: a collection with no rule is readable by nobody. Records are owner-scoped, so one customer cannot read another's. The fields that decide what you have paid for — plan, subscription state, credits, roles — are writable only by the server after Stripe confirms payment.
Enforced in firestore.rules, deployed with the application.
For Solutions customers, mail, files, calendars, and SharePoint content live in your tenant, in your name, under your billing. Automations read and write there through Microsoft Graph, under a consent your own admin grants in your admin center and can withdraw at any time. We do not copy your content into a store of ours to make a workflow run.
See the Microsoft security detail for scopes, revocation, and data locations.
IMPRESSIONSDIRECT360 LLC is a Missouri limited liability company operating from 701 Market St Ste 110 #2008, Saint Louis, MO 63101-1824. Support is answered by the people who build the product, on the phone number and address published below.
+1 (314) 339-4936 · support@impressionsdirect360.com · Monday–Friday, 9:00 AM – 6:00 PM Central
Card details are entered directly into Stripe's hosted fields and never reach our servers. What we store is a customer token, the last four digits, and subscription state. There is no card number in our database to lose.
All billing runs through Stripe Checkout and the Stripe webhook.
Decided, not delivered — do not buy on these
We have not been audited by anyone, and we hold no security certification. When we engage an auditor we will say who, for what scope, and when the report is expected — and we will not describe the engagement as a certification until a report exists.
Not started.
Our plans state an automation uptime target, not a contractual guarantee, because we do not yet run the external monitoring that would back one. The next step is a public status history that you can check without asking us.
Targets are stated as targets everywhere on the site until this exists.
We record what automations do, but there is no self-service screen where you can browse your own audit trail yet. Today you ask us and we send it. A customer-facing view is planned.
Available on request; no UI yet.
Today your Microsoft 365 admin consents to a named ID360 application from inside your own admin center. Its permissions are tenant-wide, not confined to the mailboxes and sites you nominate; pointing the automations at only those is our configuration choice, not a boundary Microsoft enforces. That consent has no expiry date — it ends when you withdraw it, and our access stops immediately. If our reseller enrolment with Microsoft completes we would move to granular delegated admin (GDAP), which adds scoped roles with a hard expiry; that is not how we work today. Either way, we have not built software that manages, reviews, or reports on those relationships; Microsoft's admin center is the system of record, and yours to control.
A working practice, not a product feature.
If a control below matters to your purchase, we are not the right fit today and we will tell you that on the first call rather than in a procurement questionnaire six weeks later.
Every vendor that can touch customer data, what they do, what reaches them, and where they process it.
View the listHow to reach us, what we do in the first hours, and what we commit to telling you.
Read the commitmentGraph scopes, the access you consent to and how you revoke it, tenant isolation, and where each kind of data lives.
See the Microsoft detailSend it over. If the answer is “not yet”, that is the answer you will get.