Data protection and information security are key elements of Worksuite’s products and services, and customers’ data protection is our highest priority.

We have implemented technical and organizational measures to ensure the secure processing of information.

Our practices are based on the legal framework of the European General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA) as well as common standards and guidelines such as SOC2.

Data protection

Data Retention

We retain our user’s data for a period of 90 days after the service termination. All data is then completely removed from our server. Every user can request the removal of usage data by contacting support.

Data Storage

Worksuite’s data is hosted in Amazon Web Services (AWS) facilities in the USA, Canada, and Ireland (EU). Worksuite was built with disaster recovery in mind. All of our infrastructure and data are spread across 3 AWS availability zones and will continue to work should any one of those data centers fail.

Data ownership

The customer is and remains the owner and controller of the data within the meaning of art. 24 EU GDPR. In particular, this means that the customer is responsible for respecting the rights of data subjects (chapter 3 of EU GDPR). Worksuite is the order processor and in this capacity processes customer’s data exclusively at the customer’s instruction and for the purposes laid down in the data processing agreement.

User protection

SSO
Single Sign-on (SSO) allows you to authenticate users in your own systems without requiring them to enter additional login credentials Click here to learn more about available integrating your SSO with Worksuite.

Permissions
We enable permission levels within the app to be set for your teammates. Permissions can be set to include app settings, billing, user data or the ability to send tasks or access reports.

Suspicious user behavior monitoring
We use Sqreen to monitor suspicious behaviors and react fast in case of account takeovers. It also protects customers against data theft by blocking credential stuffing or brute force attacks.

Secure development

We use the following best practices to ensure the highest level of security in our software:

Developers participate in regular security training to learn about common vulnerabilities and threats
We review our code for security vulnerabilities
We regularly update our dependencies and make sure none of them has known vulnerabilities
We use Static Application Security Testing (SAST) to detect basic security vulnerabilities in our codebase
We use Dynamic Application Security Testing (DAST) to scan our applications

Business continuity and disaster recovery

We back up all our critical assets and regularly attempt to restore the backup to guarantee a fast recovery in case of disaster. All our backups are encrypted.

Network and application security

Hosting and Storage
Worksuite services and data are hosted in Amazon Web Services (AWS) facilities in the USA and Ireland. Worksuite was built with disaster recovery in mind. All of our infrastructure and data are spread across 3 AWS availability zones and will continue to work should any one of those data centers fail.

Virtual Private Cloud
All of our servers are within our own virtual private cloud (VPC) with network access control lists (ACLs) that prevent unauthorized requests from getting to our internal network.

Back Ups and Monitoring
Worksuite uses AWS’s backup solution for datastores that contain customer data. On an application level, we produce audit logs for all activities. All actions taken on production consoles are logged.

Permissions and Authentication
Access to customer data is limited to authorized employees who require it for their job. Worksuite is served 100% over https. We have Single Sign-on (SSO) and strong password policies on all internal tools and applications to ensure access to cloud services are protected.

Encryption
All data sent to or from Worksuite is encrypted in transit using 256 bit encryption. Our API and application endpoints are TLS/SSL only and score an “A+” rating on Qualys SSL Labs‘ tests. This means we only use strong cipher suites and have features such as HSTS and Perfect Forward Secrecy fully enabled.

Pentests and Vulnerability Scanning
Worksuite uses third-party security tools to continuously scan for vulnerabilities. Our dedicated security team responds to issues raised. Twice yearly we engage third-party security experts to perform detailed penetration tests on the Worksuite application and infrastructure.

Incident Response
Worksuite implements a protocol for handling security events which includes escalation procedures, rapid mitigation and post-mortem. All employees are informed of our policies.

Employees

Access
Our strict internal procedure prevents employees from gaining access to user data. Limited exceptions can be made for customer support.

IP Protection
Our employees sign a Non-Disclosure and Confidentiality Agreement to protect our customer’s sensitive information.

Training
All employees complete Security and Awareness training annually.

Security Questions?

If you think you may have found a security vulnerability, please get in touch with our security team at security@worksuite.com