Getworkflex

Getworkflex hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@getworkflex.com or via a /security page (Getworkflex lists a security contact).

Getworkflex lists 10 subprocessors on its trust center, including Google Cloud EMEA Limited , Microsoft B.V., Kombo Technologies GmbH, Taktile GmbH, WorkFlex Germany GmbH. Buyers use this for fourth-party risk review.

Getworkflex hosts on AWS, GCP, and handles Customer personally identifiable information, Employee personally identifiable information, Credit card information, Personal health information. Data residency details are on its trust center.

Getworkflex's trust center is at https://trust.getworkflex.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Customer data is secured with 256-bit AES encryption at rest and SSL/TLS encryption in-transit. We currently support TLS 1.2 and 1.3. TLS 1.0 and 1.1 are no longer supported.

The customer data is stored in Frankfurt, Germany in a Google Cloud Datacenter. Backups are stored in a separate site at a different hoster in Finland. We provide GDPR-compliant hosting and data processing via our cloud service provider. Customers' data is stored exclusively in the European Union.

Based on the EU AI Act, all our use of AI is categorized are either considered "minimal risk" or "limited risk". For the detailed AI risk assessments and compliance analysis, please reach out to your WorkFlex Customer Success Manager. Generally, we only use the AI models provided in Google Cloud Platform in our own GCP tenant. Therefore, no data is sent back to the original author of the model during use or as feedback for continued learning. Here is an overview over the features currently implemented: - We use an AI agent in our support chat to help handle some the support requests, if users interacts with the popup it in the bottom right corner in the platform. The agent can access some profile fields like email and name and the trips of the user and also works on the information provided to it directly by the user. (Limited risk). - An AI analytics assistant is available in the analytics dashboards so HR Admins can dynamically edit and generate charts and reports based on anonymized data. (Limited risk) - If the Email-CC integration feature is enabled, there is an AI-based extraction system running that extracts trip information from emails. (Minimal risk) - If the SOS feature is enabled, there is an AI-based translation system translating the alerts from our alert provider to the user's language. (Limited Risk) We are happy to share the AI Risk Assessment documents with you upon request. Going forward, we are planning to add more AI agents working on anonymized data at different parts of the products so clients can interact with them.

Your data is physically separated from the data of other clients. In our database, every client has a separate database schema with separate tables storing only the data for this specific client. In addition to that, there is a specific database user associated to each client which can only read and write to this client's database schema. This database user is then used for all read and write operations triggered by employees of the client for reading, processing and visualizing any client data.

All data is collected and stored seperated. Data processing is limited to the minimal requirements necessary to fulfill our promised service offerings.

Yes, we support SSO via Open-ID connect which is supported by all major identity providers like Microsoft Entra ID / Azure AD, Okta, Google, SAP CIS and more.

If data is not needed for a specific use case, we generally do not transmit and display it at all, instead of masking it just in the UI. In some cases (e.g. dashboards), we need some of the data but not the association to a specific person, so data is anonymized.

No, data is not exchanged between our internal testing and production environment. The networks are and systems are entirely separated.

WorkFlex Standard RPO (Recovery Point Objective): 0 Hours - What this means for you: We use real-time data mirroring. In the event of a failure, there is zero data loss. Your work is preserved right up to the moment of the disruption. WorkFlex Standard RTO (Recovery Time Objective): 12 Hours - What this means for you: This is our "downtime" limit. If a system goes down, we guarantee to have your services restored and fully functional within 12 hours. WorkFlex Service Availability: 99.5% - What this means for you: This is our commitment to system reliability. It means that throughout any given month, our services are guaranteed to be accessible and operational 99.5% of the time.