What security measures does Financials for Office 365 provide? Financials for Office 365 is hosted on Microsoft's Azure in Australia, which is IRAP assessment and compliance certified. Microsoft Azure provides a range of cloud services that are considered to inherit the security controls and attributes of the assessed core services. The scope of assessment included the following services: Virtual Machines, Cloud Services, Storage Services, Virtual Network, Azure SQL DB, Azure Active Directory; Global Foundation Services (providers of the global network and physical infrastructure); and Australian Data Centre facilities. The IRAP assessment was conducted to determine whether the system architecture (including information security documentation) is based on sound security principles and has addressed all applicable controls from the ISM (Australian Government Information Security Manual). An assessment was also conducted whether the controls have been implemented and are operating effectively. Validation included onsite inspections, personnel interviews, process demonstrations, configuration reviews and review of existing certification reports and evidence. In other words, if Azure (which Financials for Office 365 is hosted in) has passed stringent government security compliance, it should be more than good enough for the rest of us.