Enterprise Security Standards

SOC 2 Type II Certified

TonicDM is SOC 2 Type II certified, ensuring that we meet rigorous standards for the security, availability, and processing integrity of customer data.

Single Sign-On (SSO)

Supports SSO via Azure Active Directory (Entra ID) and Okta, allowing for centralized user management and seamless access control.

Multi-Factor Authentication (MFA)

The platform supports multifactor authentication, aligning with enterprise security standards to prevent unauthorized access.

Zero-Touch Provisioning

Because the integration is part of your Office 365 installation and linked to Active Directory, new staff members are automatically provisioned.

You Own Your Data

Your project history should belong to you, not to a vendor.

TonicDM is architected so customers own their data outright and keep full control over how and where it lives. There are no data silos or hidden constraints—your records stay portable, independent, and available on your terms.

TonicDM provides a complimentary S3 sync service that mirrors your project data from TonicDM’s S3 to your own cloud bucket, on a daily or monthly schedule. You always hold an independent, redundant copy of your records.

The platform supports effectively unlimited storage, with no caps on the number of projects or content volume. It scales with your practice using elastic cloud infrastructure.

Files uploaded for sharing or archival are locked as read-only, timestamped, and tracked in a complete, searchable audit trail. This creates immutable records that support legal defense and preserve your version of events.

Integration, Email, and Security

Org-Level 365 Integration

TonicDM has a deep integration with your Microsoft 365 tenant, treating the software as an extension of your firm's existing infrastructure.

LEARN MORE →

Under-the-Hood Integration: The integration runs within the Office 365 tenant. It is not a separate client-side installation but is part of the Office 365 deployment. It operates as a modern web add-in compatible with PC, Mac, and Outlook Web, ensuring security consistency across endpoints.

Identity Management: Direct integration with Azure Active Directory (Entra ID) for identity management, supporting SSO and MFA.

Analytics: Project data supports advanced analytics via Microsoft PowerBI. 

How TonicDM works with your email

We don't replace your mail server. TonicDM is a Project Information Management system, not a mail transport agent or mail server.

LEARN MORE →

Data Separation: It functions as a project repository that is separate from Outlook. It creates a copy of emails and attachments in the project repository so data is archived and indexed independently of individual user mailboxes. 

What This Means: TonicDM works alongside your Microsoft 365 environment—it preserves project records without intercepting your messages. When you file an email to a project, it creates a structured copy for the project archive while your original email remains in your inbox (where you can delete it if desired).

Integration Security Architecture

When integrating with Procore, TonicDM uses Procore Permission Mirroring, not a blanket admin token. It operates on a user-level permission basis.

LEARN MORE →

How It Works:

  • The user connects their TonicDM account to Procore using their own credentials
  • Procore then grants TonicDM the right to access data "as if it was that user"
  • Procore's security restricts access just as it would if the person had logged into the Procore website
  • If a user's permissions are changed or revoked in Procore, that user in TonicDM is immediately restricted in the same way

This security-first architecture ensures that permissions are always mirrored exactly, with no backdoor access.

Cloud-Native Infrastructure

100% Cloud-Based

TonicDM is fully cloud-based (SaaS), utilizing the cloud capabilities of Microsoft 365 to their full extent. This eliminates the need for on-premise servers, local indexers, or backup tapes.

Off-Premise Data

Project data is kept in a secure cloud location, helping reduce the attack surface associated with on‑premise systems.

Infrastructure Cost Savings

Because the platform is cloud-native, infrastructure costs such as server space, backups, archives, and IT staff maintenance are greatly minimized.

Explore the Trust Center

For firms that need to go deeper, TonicDM provides full security documentation, architecture diagrams, and compliance certifications in our Trust Center. Direct security inquiries are welcome.

Visit the Trust Center