Security is about prevention – controlling who can access what and what they can do with it. Compliance is about proof and lifecycle – demonstrating what actually happened, proving access was appropriate at every moment, and enforcing what happens to the data after the project ends. A system can be secure and still non-compliant: it can prevent unauthorized access but leave you unable to prove it did, or unable to dispose of data when retention ends. Govern 365’s Compliance layer adds the proof and lifecycle to the security that Microsoft 365 already provides.

Recertification runs on a cadence you define – quarterly, annually, or event-triggered. Room owners receive a prompt to review every user’s access and explicitly recertify or revoke it. Users whose access isn’t recertified within the window are automatically removed, with the revocation captured in the audit log as a policy-driven event. Disposition works similarly for content: when retention policies expire, the smart disposition engine deletes, archives, or routes the content to a human reviewer based on configurable rules. Every action produces a certificate.

Yes. Every record – audit logs, retention events, recertification decisions, disposal certificates – stays inside your Microsoft 365 tenant, governed by the same policies your compliance team already maintains in Microsoft Purview. Govern 365 never stores records on our infrastructure. This matters because your regulatory certifications (SOC 2, HIPAA, GDPR) apply to your tenant – not to a vendor’s cloud. Tenant-resident governance means your compliance posture is whole and traceable, not split between your environment and a third-party silo.

Yes. The lifecycle governance engine applies to any SharePoint site or Microsoft 365 group – not just deal rooms. Typical extensions include project workspaces, client engagement folders, board reporting sites, regulatory submission repositories, and supplier collaboration rooms. The same recertification, retention, disposition, and certificate-of-destruction workflows apply. Many customers start with VDR-grade compliance for deals, then extend the controls to their broader collaboration estate once they see the model works.

Yes. Audit log entries in Govern 365 cannot be edited or deleted, and the sequence is cryptographically chained – each entry references the hash of the previous entry, so any alteration or removal breaks the chain detectably. This is the standard required by SOC 2, ISO 27001, and most regulator frameworks for audit integrity. When a regulator or auditor asks for the chain-of-custody evidence, you can prove not just what the log says, but that the log hasn’t been tampered with.

When content reaches the end of its retention period or a deal room is disposed of, Govern 365 generates a cryptographically signed certificate documenting what was disposed, when, under which policy, by whose approval, and using what disposal method. The certificate is tamper-evident and permanently retained in your tenant – even after the underlying content is gone. This is the artifact regulators, counterparties, and insurance carriers ask for when they need proof that content was destroyed properly, not just “deleted.”

Yes. Legal hold integrates with Microsoft Purview eDiscovery. When a hold is placed on a room or a document, all retention-driven disposition is suspended for content in scope, with the hold itself captured as an audit event. When the hold is lifted – or amended to a narrower scope – normal retention resumes automatically. Hold events, releases, and scope changes are all audit-logged so the chain of custody remains complete.

Immutable audit logs, policy retention, and certificates of destruction are included in every edition starting with Founder ($2,400/year). Advanced compliance automation – recertification and smart disposition – is available on Enterprise Edition. NDA enforcement starts with Growth Edition. The CIS Security Assessment is available to all customers as a one-time engagement.