Humanforce

Humanforce is SOC 2 Type II compliant. On SOC2C this listing is Listed.

According to Humanforce's public trust center, Humanforce is ISO 27001 certified. On SOC2C this listing is Listed.

According to Humanforce's public trust center, Humanforce is GDPR compliant. On SOC2C this listing is Listed.

Humanforce is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.

Yes. Humanforce's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Humanforce is certified for both ISO 27001 and SOC 2 Type II, demonstrating our commitment to implementing and maintaining robust information security management systems and adhering to global standards for data security, privacy, and operational integrity.

No. Humanforce does not permit customers to run vulnerability scans or penetration tests against our environments. Our infrastructure is shared across customers, and unauthorised scanning can impact performance, trigger security alerts, and lead to inaccurate results. We already conduct regular penetration testing and vulnerability scanning in a controlled and isolated manner, including: - External third-party penetration tests with code-assisted reviews - Continuous internal vulnerability assessments - Annual independent security audits aligned with our compliance frameworks For customers who require assurance, detailed reports and summaries are available through the Humanforce Trust Centre.

Humanforce employs a multi-layered approach to data security, including: - ISO 27001 compliance: Ensuring a robust information security management system. - SOC 2 Type II compliance: Protecting data across key trust service principles. - Encryption: Data is encrypted both in transit and at rest. - Threat Monitoring: Continuous monitoring and threat detection systems. - Third-party Testing: Regular independent penetration tests.

Upon contract termination, Humanforce ensures: - Secure Data Deletion: Removing all data securely. - Processes align with applicable data protection regulations and contractual obligations.

Facial recognition feature is designed with privacy and security in mind. The following controls apply to the collection, processing, and storage of facial recognition data: - Facial analysis is primarily performed locally on trusted devices. Some facial processing may occur on Humanforce backend servers during administrative operations such as user migration. - Face registration data and images are stored in the customer’s SQL database and encrypted at rest. No facial recognition data is shared with any external party. - Anonymised facial vectors (not images) may be temporarily cached in the browser on trusted devices to support recognition. These vectors are ephemeral and not persisted on the server. - All data transmission between the front-end and back-end is encrypted in transit. - All associated facial recognition data is automatically deleted from the system upon employee termination.