tresorit

• Discovery and planning (1–2 weeks)

• Stakeholder kickoff: IT, security, legal/compliance, and business units align on goals (data sovereignty, zero-knowledge encryption, end-user workflows).

• Requirements gathering: users, data types, folders, retention policies, DLP needs, and integration points (SSO, SCIM, identity providers, backup/archiving, EHR/PHI or HIPAA considerations if applicable).

• Compliance and risk review: determine if additional certifications or audits are needed (e.g., SOC 2, ISO 27001, GDPR alignment).

• Architecture and design (1–3 weeks)

• Information architecture: folder structure, tenancy/organization setup, permission models (groups vs. individuals), external sharing policies.

• Identity and access: plan for SSO/IdP (SAML 2.0, OpenID Connect), SCIM provisioning, MFA requirements.

• Security controls: key management strategy, device management, on-prem vs. cloud backups, data residency considerations.

• Integration plan: endpoints for desktop/mobile apps, web, connectors for existing workflows (Windows/macOS, Linux clients if needed), and API usage.

• Deployment and configuration (2–6 weeks)

• Tenant provisioning: create the Tresorit organization(s), users, groups, and roles.

• Policy setup: encryption keys handling (default zero-knowledge setup), sharing permissions, link expiration, watermarking (if applicable).

• Device and client rollout: install clients on user devices, configure automatic updates, MDM/MDM-like controls if used.

• Identity integration: connect with IdP, configure SCIM provisioning, and set up MFA.

• D. Data onboarding (varies by data size and complexity)

• Data migration plan: decide which folders/files move to Tresorit, any data cleansing, and retention rules.

• Pilot phase: a small group tests workflows, sharing, external collaboration, and security controls.

• Full rollout: phased user adoption with training materials and support.

• E. Testing and validation (1–3 weeks)

• Functional tests: sharing, external access, collaboration, and workflow automation.

• Security validation: access controls, data leakage checks, backup/restore tests.

• Compliance checks: verify logging, retention, and governance meet policy requirements.

• Training and handover (1–2 weeks)

• User training: how to share securely, manage permissions, and use client apps.

• Admin training: how to manage users, enforce policies, monitor activity, and respond to incidents.

• Documentation: runbooks, security policies, and escalation procedures.

• Customization options (typical)

• Identity and access: SSO integration (SAML/OpenID Connect), SCIM provisioning, custom attribute mappings

• Governance and policy: configurable sharing rules (internal vs external), link expiration, passwordless access, device trust policies, offline access controls.

• Data residency and tenancy: ability to choose data regions or cloud provider options where available; multi-tenant vs single-tenant considerations.

• Branding and UX: client branding, help resources, and customization of end-user messaging

• APIs and automation: use of Tresorit APIs for workflows, custom automations, and integrations with existing ITSM/PSA/CI/CD pipelines.

• Backup/restore and retention: configurable backup windows, retention policies, and eDiscovery or legal hold features when applicable.

• External collaboration: granular controls for guest access, domain allow/deny lists, and audit trails for sharing activity.

• Limits and considerations

• Feature parity by plan: many customization options are tiered by plan (e.g., Business, Enterprise, or specific security/add-ons). Some advanced governance features may require an Enterprise plan or a dedicated customer success engagement.

• Custom development: Tresorit typically offers standard APIs and integrations; for bespoke automation or connectors, you may engage professional services or a partner, which can affect timelines and cost.

• Compliance-specific adaptations: HIPAA/HITECH, GDPR, and other regulatory requirements may necessitate additional configurations or audits; these can impact both timeline and pricing.

• . Practical data points to collect when planning customization

• Number of users and groups; expected growth rate.

• IdP in use (Azure AD, Okta, Google Workspace, Ping Identity, etc.) and SCIM provisioning needs.

• Data categories to store (documents, contracts, design files, PHI/PII) and applicable retention policies.

• External sharing needs (vendors, customers) and the required restrictions.

• Required security controls (MFA methods, device management, DLP or watermarking).

• Any required integrations (EDR/SIEM, backup solutions, content management systems, collaboration tools).

• Common cost components

• Subscription license: per-user or per-seat pricing based on plan level (e.g., Business, Enterprise). Often includes standard features; higher-tier plans unlock advanced security and governance.

• Onboarding/setup fees: some vendors charge a one-time implementation/consulting fee, especially for complex deployments or large enterprises.

• Professional services: for custom integrations, data migration, or tailored workflows; billed as time-and-materials or fixed-price engagements.

• Training: can be included or billed separately, depending on the package and region.

• Support and maintenance: standard support usually included in the plan; premium or enterprise-level support (24/7, dedicated CSM, faster response times) may incur additional fees.

• External sharing and collaboration costs: some tiers impose limits or additional costs for external guests or domain-level sharing.

• Typical ranges (illustrative, varies by region and contract)

• Starter/Business plans: base per-user license, often with volume discounts for larger user counts.

• Enterprise plans: higher per-user cost, with added governance, advanced security features, premium support, and more extensive admin controls.

• Onboarding/setup: a one-time fee that can range from a few thousand to tens of thousands USD, depending on data volume and scope.

• Professional services: hourly rates or fixed-price engagements; common ranges might be several thousand to tens of thousands USD for migration, integrations, and custom automation.

• Training and support add-ons: optional, may range from a few hundred to several thousand USD depending on scope.

• User onboarding materials

  • Getting started guides and quick-start checklists

  • How-to articles for common tasks: sharing, group management, and offline access

• In-app guidance

  • Onboarding prompts and tips within the client apps to help users perform essential tasks

• Admin-focused training

  • Admins receive guidance on user provisioning, policy enforcement, auditing, and incident response

• Training formats

  • Self-paced e-learning or knowledge base access

  • Live webinars or virtual workshops (often offered by Tresorit or partner teams)

  • In some engagements, custom training sessions tailored to the organization’s policies

• Documentation

  • Official product docs, release notes, and best practices for security, governance, and governance workflows

• Enablement for external sharing

  • Tutorials on configuring external sharing, guest access, and domain restrictions

Support options

• Included support (standard)

  • Access to basic support during business hours

  • Help center, knowledge base, and community resources

• Priority and premium support (higher tiers)

  • Faster response times (e.g., 2–4 hours for critical issues, depending on plan)

  • 24/7 support often available for enterprise agreements

  • Dedicated customer success manager or technical account manager in some Enterprise contracts

  • Proactive health checks, best-practice reviews, and quarterly governance reviews

• Incident management

  • Structured incident response processes, root-cause analysis, and post-incident review

• Custom success metrics

  • Some enterprise arrangements include success plans, onboarding milestones, and regular health/status review

• Training and enablement add-ons

  • Optional formal trainings, workshops, or certified training programs at an additional cost

• Encryption and zero-knowledge architecture

  • Data encrypted in transit (TLS) and at rest

  • Zero-knowledge encryption model for client-side data where applicable, meaning Tresorit cannot access plaintext content

• Key management

  • Client-side key handling with options for managed or customer-provided keys in some configurations

  • Controls around key escrow or key management workflow as per policy

• Access control and identity

  • SSO integration (SAML 2.0, OpenID Connect)

  • SCIM provisioning for automated user lifecycle management

  • Multi-factor authentication (MFA) enforcement

  • Granular permissions: user/group-based access, domain restrictions, and fine-grained sharing controls

• Data residency and compliance

  • Options for data residency in certain regions and cloud providers (availability varies by plan)

  • Compliance considerations (SOC 2, ISO 27001, GDPR alignment) and audit logging

• Secure collaboration

  • Granular external sharing controls (expiring links, password protection, domain restrictions)

  • Activity logging and audit trails for governance and incident response

• Endpoint and device security

  • Device management options, policy enforcement, and support for managed devices

  • Awareness around offline access controls and secure synchronization

• Data protection features

  • DLP, watermarking, and data loss prevention features where offered

  • Backup/archiving capabilities and retention policies

• Incident response and resilience

  • Regular security testing, vulnerability management, and incident response planning

  • Disaster recovery and failover options in line with enterprise needs

• Release frequency

  • Tresorit typically maintains a regular release cycle with cumulative updates. This can include major version updates and smaller feature/security updates on a monthly or quarterly basis, depending on the product line and region.

• Update channels

  • Client applications (desktop, mobile) auto-update or prompt users to update

  • Web app updates are rolled out server-side automatically

• Change management and communications

  • Release notes detail new features, security improvements, bug fixes, and any breaking changes

  • Administrators usually receive advance notifications for significant changes, with guidance on impact and migration steps

• Testing and compatibility

  • Updates are tested for compatibility with supported OS versions and commonly used IdP integrations

  • Backward compatibility considerations are typically documented in release notes

• Rollback and remediation

  • In case of critical issues, there are processes for rapid remediation and, if necessary, rolling back changes or providing workaround guidance

• Data ownership

  • Typically, you (the customer) own your data stored in Tresorit. Tresorit acts as the processing/storage platform.

  • Tresorit and its role are described as a data processor under applicable data protection laws; the data controller remains with the customer for personal data you upload.

• Data access and control

  • Customers control data within the Tresorit environment, including permissions, sharing settings, retention, and deletion policies.

  • Access to data by Tresorit is generally only as permitted by the customer’s policies (e.g., for support, security, or incident response) and in line with the contract and legal requirements.

• Data portability

  • Data portability rights typically align with GDPR-style expectations: customers should be able to export their data in common formats (e.g., documents, metadata) upon request or contract termination.

  • Portability arrangements may include bulk export options, API-assisted extraction, or assistance from professional services for data migration to another system.

• Data deletion and retention

  • Retention policies are defined by the customer and enforcement of deletion requests (sanitization of data) is part of the service.

  • Secure deletion processes and any required deletion verification are typically documented in the service agreement or data processing addendum (DPA).

• Scaling up (growth)

  • Add more seats/users, increase storage, and enable additional features or governance capabilities.

  • Pricing adjustments are typically proportional to the added license count and storage, often with volume discounts or tier changes.

  • Onboarding support and implementation assistance may be offered for larger deployments.

• Scaling down (reduction)

  • Reduce user licenses, storage quotas, or disable optional features.

  • There may be minimum-term commitments or notice periods for reductions; some costs may be fixed for a given term and not prorated.

  • Data retention requirements still apply; ensure data needed for archival or compliance is retained before deactivating access.

• Change management considerations

  • Many Enterprise agreements include a renegotiation clause or amendment process to reflect changes in scale.

  • There may be transition plans to avoid data loss or service disruption during scale changes.

• Notice and terms

  • Scaling changes typically require a notice period (e.g., 30–90 days) to adjust billing, provisioning, and support commitments.

• Renewal terms

  • Most Tresorit contracts are on fixed terms (annual, multi-year) with auto-renewal unless canceled.

  • Renewal pricing can be subject to increases or negotiated terms; you may lock in pricing for a term or receive an updated quote at renewal.

  • SLAs, support levels, and feature sets often reset or renegotiate at renewal.

• Termination rights

  • Termination for convenience: many enterprise contracts allow termination with notice, often with a ramp-down period and payment of any remaining balance.

  • Termination for breach: rights to terminate for uncured material breach, typically after notice and a cure period.

  • Immediate termination: in cases of safety/compliance violations or misuse (as defined in the agreement), with potential data return requirements.

• Data handling on termination

  • Upon termination, customers typically have a defined period to export data.

  • After the grace period, data may be securely deleted per the DPA, subject to legal hold or regulatory requirements.

• Migration assistance

  • Some agreements include data export/migration support as part of the termination process or as a paid service.

• Renewal negotiation and exit clauses

  • Renewal terms may include price protection, performance-based SLAs, or service credits.

  • Exit clauses may specify transition assistance windows and obligations for both sides.

• SOC 2 (Type II) or SOC 2 readiness assessments

• ISO 27001 (information security management)

• GDPR readiness and data processing addendum (DPA) for EU data protection

• HIPAA/HITECH readiness or business associate agreements (BAA) may be available for customers in regulated sectors, often requiring a dedicated configuration or addendum

• Privacy laws and data sovereignty commitments, with potential data residency options depending on plan and region

• Data residency and cross-border data transfers

  • Options to specify data residency in certain regions or cloud providers (availability varies by plan)

  • Mechanisms to ensure data transfers comply with applicable cross-border data transfer rules (e.g., SCCs, DPAs)

• Security controls alignment

  • Regular vulnerability management, penetration testing, and incident response capabilities

  • Audit logging and access controls aligned with governance requirement

  • Encryption standards (in transit and at rest), key management options (customer-managed keys in some configurations

• Certifications and attestations

  • Tresorit may provide report access or attachments for auditors (SOC 2 reports, ISO certificates) under NDA or through customer portals