Getworkflex

Getworkflex is SOC 2 compliant. On SOC2C this listing is Listed.

According to Getworkflex's public trust center, Getworkflex is ISO 27001 certified. On SOC2C this listing is Listed.

Yes. Getworkflex's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Getworkflex hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Security isn't a single yes/no, but Getworkflex is SOC 2 compliant. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Customer data is secured with 256-bit AES encryption at rest and SSL/TLS encryption in-transit. We currently support TLS 1.2 and 1.3. TLS 1.0 and 1.1 are no longer supported.

The customer data is stored in Frankfurt, Germany in a Google Cloud Datacenter. Backups are stored in a separate site at a different hoster in Finland. We provide GDPR-compliant hosting and data processing via our cloud service provider. Customers' data is stored exclusively in the European Union.

Based on the EU AI Act, all our use of AI is categorized are either considered "minimal risk" or "limited risk". For the detailed AI risk assessments and compliance analysis, please reach out to your WorkFlex Customer Success Manager. Generally, we only use the AI models provided in Google Cloud Platform in our own GCP tenant. Therefore, no data is sent back to the original author of the model during use or as feedback for continued learning. Here is an overview over the features currently implemented: - We use an AI agent in our support chat to help handle some the support requests, if users interacts with the popup it in the bottom right corner in the platform. The agent can access some profile fields like email and name and the trips of the user and also works on the information provided to it directly by the user. (Limited risk). - An AI analytics assistant is available in the analytics dashboards so HR Admins can dynamically edit and generate charts and reports based on anonymized data. (Limited risk) - If the Email-CC integration feature is enabled, there is an AI-based extraction system running that extracts trip information from emails. (Minimal risk) - If the SOS feature is enabled, there is an AI-based translation system translating the alerts from our alert provider to the user's language. (Limited Risk) We are happy to share the AI Risk Assessment documents with you upon request. Going forward, we are planning to add more AI agents working on anonymized data at different parts of the products so clients can interact with them.

Your data is physically separated from the data of other clients. In our database, every client has a separate database schema with separate tables storing only the data for this specific client. In addition to that, there is a specific database user associated to each client which can only read and write to this client's database schema. This database user is then used for all read and write operations triggered by employees of the client for reading, processing and visualizing any client data.

All data is collected and stored seperated. Data processing is limited to the minimal requirements necessary to fulfill our promised service offerings.