How can we help your organisation?

Use IMAP to read and SMTP to send, with host mail.totuldigital.ro: IMAP port 993 (SSL/TLS), SMTP port 587 (STARTTLS) or 465 (SSL/TLS). The username is your full email address.

Mail apps sign in with your mailbox password. If you do not have one, write to support@totuldigital.com. Device passwords from Settings are for calendars, contacts and files.

Step-by-step guides are in the documentation.

Add a CalDAV or CardDAV account with server totuldigital.com. Most clients find the rest automatically through /.well-known/caldav and /.well-known/carddav.

Sign the client in with a device password, created in Cloud Office under Settings. The account password is refused for sync on purpose, so two-factor sign-in and sync can both be on. A device password is shown once and can be revoked on its own.

See Calendars and contacts and Device passwords.

Open the file in Files and choose Share. A link can have a password and an expiry, and you can turn it off at any time. Anyone with the link (and the password, if set) can download the file.

Files are also reachable over WebDAV: see Files over WebDAV.

In Cloud Office open Settings and turn on two-factor sign-in: scan the QR code with an authenticator app and confirm with a six-digit code. Keep the recovery codes somewhere safe; each one works once.

It watches your servers, your Cloud Office and your cloud accounts continuously: alerts for attacks and suspicious sign-ins, a threat map, every machine scored against its CIS benchmark, known vulnerabilities in installed software, and evidence mapped to twelve frameworks including NIS2, DORA, ISO/IEC 27001:2022 and GDPR Article 32.

It is in the client portal under Security & Compliance. See Getting started and the module page.

In Security & Compliance › Fleet, choose Add servers and run the command it shows on each Linux server, as root. The link in it is valid for 24 hours and enrols as many servers as you like. The server needs outbound TCP 1514 to sensors.totuldigital.com.

Step by step, with troubleshooting: Adding servers.

Yes, read-only through their audit logs: Amazon Web Services, Microsoft Azure, Google Cloud, Microsoft 365, Google Workspace, Okta and GitHub, with others on request. Secrets are sealed with AES-256-GCM and never shown again. See Connecting cloud accounts.

Evidenced: the monitoring shows the control working. Gap: it shows something wrong, and names it. No data: nothing it can see decides the control — backups, suppliers, training, policies — so it waits for your records. No data is never counted as a pass.

More in Compliance and evidence.

High and critical detections appear immediately on the Overview and in the live alert stream, and Events can be filtered to them. Compliance is scored continuously; reports are made on demand for any period.

No. Cloud Office reports who signed in, what was shared and what administrators changed — never message bodies or file contents. Server sensors read system logs, the package inventory and configuration checks, not your databases.

No. It observes and reports, and has no way to change your systems. Each finding says what is wrong and how to fix it; your team or your IT supplier makes the change, and the next scan shows whether it worked.

No. Every organisation is kept apart: every request runs under accounts that can read only that organisation's data, enforced by the monitoring service itself rather than by a filter.

Per framework and period: an executive summary, key indicators with their trend, the control matrix with its evidence, top threats, vulnerabilities and hardening, and the incidents. They download as JSON today. See Security reports.

It gives you continuous monitoring and audit-ready evidence for your auditor and regulator. It does not replace legal advice or a certification audit; it makes both faster.

Directive (EU) 2022/2555, the EU law on cybersecurity for essential and important entities in eighteen sectors. Member States had to write it into national law by 17 October 2024; it applies from 18 October 2024.

Everything about it is in NIS2 explained.

Two things decide it: whether your activity is one of the eighteen sectors in Annex I or II, and whether you are at least medium-sized (50 or more staff, or more than €10 million turnover and balance sheet). Some entities are in scope whatever their size.

Run the four-question check and confirm with your national authority.

Supervision and fines, not the measures. Essential entities are supervised proactively and face fines of at least up to €10 million or 2% of worldwide turnover; important entities after the fact, at least up to €7 million or 1.4%. See Essential or important.

Ten risk-management measures (Article 21), from risk policies and incident handling to supply chain security, cryptography and multi-factor authentication; incident reporting in stages (Article 23); registration; and management approval, oversight and training (Article 20). See the ten measures.

For a significant incident: an early warning within 24 hours of becoming aware, an incident notification within 72 hours, and a final report within one month of the notification, to your national CSIRT or competent authority. See Incident reporting and the reporting clock in the portal.

The Commission's detailed requirements for the Article 21 measures, in thirteen numbered points, and the thresholds for a significant incident. It binds digital providers directly and is the reference reading for everyone else. See the thirteen points.

At least up to €10 million or 2% of worldwide annual turnover for essential entities, and €7 million or 1.4% for important ones, whichever is higher; national law may set more. Management can be held liable. See Fines and liability.

Continuous monitoring of your servers, Cloud Office and cloud accounts, with evidence mapped to each Article 21 measure and each point of the Implementing Regulation, the Article 23 clock, and reports for your auditor. What monitoring cannot see stays visible as open. See How TotulDigital helps.

Mail is copied over IMAP, and calendars and contacts exported as .ics and .vcf files and imported. Write to support@totuldigital.com and we will help you plan it; assisted migration is included with Gold.

Yes, without asking us: mail over IMAP, files over WebDAV, calendars over CalDAV (.ics) and contacts over CardDAV (.vcf). After the contract ends you have 30 days before data is deleted.

In the sovereign jurisdiction you choose, on high-availability infrastructure with encrypted off-site backups.

Yes. Data is backed up automatically, encrypted, to a second location in your chosen jurisdiction. You can also take a full copy at any time over IMAP (mail) and WebDAV (files).

Virtual servers on the plans listed on the VPS page, provisioned from the image you choose, with your SSH key injected at first boot. See the VPS guide.

By email at support@totuldigital.com, on business days. There is no telephone line and no 24-hour cover. Security issues go to security@totuldigital.com. The legal documents are under Legal.