Welcomeworkdays

Security isn't a single yes/no, but Welcomeworkdays is SOC 2 compliant and holds GDPR, ISO 27001. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Welcomeworkdays hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@welcomeworkdays.com or via a /security page (Welcomeworkdays lists a security contact).

Welcomeworkdays lists 8 subprocessors on its trust center, including Google Cloud Platform, Sharry, Intercom, LINK Mobility Poland Sp. z o.o. , Poly API Corporation. Buyers use this for fourth-party risk review.

Welcomeworkdays hosts on GCP, and handles Customer personally identifiable information, Credit card information, Personal health information, Public IP adresses. Data residency details are on its trust center.

Welcomeworkdays's trust center is at https://trust.welcomeworkdays.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

ISO 27001:2022 is the latest international standard for information security management systems (ISMS). This certification ensures that Welcome Workdays has implemented a robust framework to protect sensitive data, manage cybersecurity risks, and maintain compliance with global security best practices.

The Welcome Access App collects personal data necessary to provide secure building access and a smooth user experience. Below is a complete overview of the data collected. User profile data When you register or are registered as a user, the app stores the following information that is visible and editable in your profile: - First name and last name - Email address / login name - Profile photo (optional – if uploaded by the user) - Related company name - Assigned building and floor - Access PIN (sent directly to the access control system, not stored by Welcome) This data is used to identify you as a user and manage your access rights within the building. Access-related data To manage and secure physical access to the building, the app processes the following: - Approximate GPS location (conditional): GPS location data is only requested if you activate the Bluetooth-based mobile access functionality and explicitly grant location permission on your device. This data is required by the BLE card provider when generating your digital access card. The location data does not leave your device and is not stored on Welcome's or our technology partner Sharry.tech's servers. We classify this as processing under GDPR as the app technically requests the permission, even though no location data is transmitted or stored externally. Technical and device data In order to ensure the app functions correctly and to improve the service, the following technical data is collected in the background: - IP address (processed as part of standard internet protocol communication) - Authentication and session tokens - Device operating system - Device type - Language settings - App version installed This technical data may be linked to your user account. It is used to facilitate secure communication between your device and our servers, and to gain statistical insights into how the app is used so we can improve the service.

The Welcome Workdays app may request location permission on your device when you activate a Bluetooth-based (BLE) access credential. This is not because the app tracks your location. Both Android and iOS classify Bluetooth scanning as a location-related capability. The reason is that proximity to a known Bluetooth device — such as an access control reader installed at a door — can theoretically be used to infer a user's physical position. Because of this, the operating system requires apps to hold location permission before they can communicate with BLE devices like door readers. Key facts: • The location permission is an operating system requirement for Bluetooth functionality — it is not initiated by Welcome Workdays. • The approximate location data obtained through this process remains on your device. It is not transmitted to, stored on, or processed by Welcome Workdays or any third party. • This permission is only requested when activating a BLE access credential. Users who exclusively use NFC-based credentials (Apple Wallet / Google Wallet) are never prompted for location permission. • On Android 12 and later, Google introduced dedicated Bluetooth permissions (BLUETOOTH_SCAN, BLUETOOTH_CONNECT) separate from location. However, the underlying hardware vendor SDKs used by access control readers may still require the legacy location permission to function. For more details, see Android's Bluetooth permission documentation at developer.android.com and Apple's Bluetooth privacy guidance at support.apple.com.