Humanforce

Humanforce hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Security isn't a single yes/no, but Humanforce is SOC 2 Type II compliant and holds SOC 2 Type II, ISO 27001, GDPR. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Humanforce hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@humanforce.com or via a /security page (Humanforce lists a security contact).

Humanforce lists 37 subprocessors on its trust center, including Amazon Web Services, Microsoft Office 365, Atlassian Cloud, Slack, Amplitude. Buyers use this for fourth-party risk review.

Humanforce hosts on AWS. Data residency details are on its trust center.

Humanforce's trust center is at https://trust.humanforce.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Humanforce is certified for both ISO 27001 and SOC 2 Type II, demonstrating our commitment to implementing and maintaining robust information security management systems and adhering to global standards for data security, privacy, and operational integrity.

No. Humanforce does not permit customers to run vulnerability scans or penetration tests against our environments. Our infrastructure is shared across customers, and unauthorised scanning can impact performance, trigger security alerts, and lead to inaccurate results. We already conduct regular penetration testing and vulnerability scanning in a controlled and isolated manner, including: - External third-party penetration tests with code-assisted reviews - Continuous internal vulnerability assessments - Annual independent security audits aligned with our compliance frameworks For customers who require assurance, detailed reports and summaries are available through the Humanforce Trust Centre.

Humanforce employs a multi-layered approach to data security, including: - ISO 27001 compliance: Ensuring a robust information security management system. - SOC 2 Type II compliance: Protecting data across key trust service principles. - Encryption: Data is encrypted both in transit and at rest. - Threat Monitoring: Continuous monitoring and threat detection systems. - Third-party Testing: Regular independent penetration tests.

Upon contract termination, Humanforce ensures: - Secure Data Deletion: Removing all data securely. - Processes align with applicable data protection regulations and contractual obligations.

Facial recognition feature is designed with privacy and security in mind. The following controls apply to the collection, processing, and storage of facial recognition data: - Facial analysis is primarily performed locally on trusted devices. Some facial processing may occur on Humanforce backend servers during administrative operations such as user migration. - Face registration data and images are stored in the customer’s SQL database and encrypted at rest. No facial recognition data is shared with any external party. - Anonymised facial vectors (not images) may be temporarily cached in the browser on trusted devices to support recognition. These vectors are ephemeral and not persisted on the server. - All data transmission between the front-end and back-end is encrypted in transit. - All associated facial recognition data is automatically deleted from the system upon employee termination.

We take security issues seriously. If you’ve identified a potential vulnerability or security issue, please contact our security team at security@humanforce.com. We encourage responsible disclosure and will work with you to address the issue promptly.

All APAC customer data is hosted in the AWS Asia Pacific (Sydney) Region, which includes three Availability Zones, all located in Sydney. All UK/EU customer data is hosted in the AWS Europe (Ireland) Region, which includes three Availability Zones, all located in Ireland. All North America customer data is hosted in the AWS US Region (N. Virginia), which includes multiple Availability Zones across the East Coast of the United States.

As a result of an unscheduled outage, the Recovery Time Objective is 8 hours.

As a result of an unscheduled outage, the Recovery Point Objective is taken from the previous night’s backup (between 1 am and 3 am).