Security and data
Built in Australia, for Australian workplace data.
Workfloor is hosted in Sydney, keeps your data in Australia and is built to the controls an HR team’s security review will ask about.
Data stays in Australia
- Workfloor is hosted on AWS in Sydney. Your questions, answers, files and account data are stored there.
- AI processing runs in Australia only, in Sydney and Melbourne.
- An account-wide policy blocks every cloud region outside Sydney and Melbourne, so data cannot be processed elsewhere by mistake.
Encryption
- At rest: the database, file storage and backups are encrypted with managed encryption keys (KMS), rotated automatically.
- In transit: TLS 1.2 or higher on every connection, including inside our own network.
- The database refuses unencrypted connections and sits in a private network with no route to the internet.
Access control
- Multi-factor authentication is required for every Workfloor account.
- Our own administrators sign in through single sign-on with MFA and short-lived sessions. There are no long-lived access keys.
- Least privilege throughout: each part of the service can reach only the data it needs.
Audit and monitoring
- Every administrative action in our hosting environment is recorded in an audit trail that is kept for 12 months and protected from alteration.
- Threat detection and configuration monitoring alert us to suspicious activity.
- Enterprise plans include an audit log of your team’s activity in Workfloor.
Backups and recovery
- Point-in-time recovery for the database covers the last 14 days.
- Daily backups of the database and file storage are kept for 14 days, encrypted with our own keys.
Your data and AI
- Customer content is never used to train AI models, ours or anyone else’s.
- Answers are stored only in your account, in Sydney, as your history.
- When you leave, we return or delete your data within 30 days, and backups expire after that.
Standards, plainly stated
We would rather tell you exactly where we are than overstate it.
Aligned with ISO/IEC 27001. Our controls are designed to align with ISO/IEC 27001:2022 Annex A and the Australian Privacy Principles. Workfloor is not certified to ISO 27001 or SOC 2. Our Statement of Applicability is available to customers on request.
Single sign-on. SSO with Google Workspace or Microsoft Entra ID is included in Enterprise and is being built now. Until it is ready, every account signs in with multi-factor authentication.
Independent testing. An independent penetration test is planned before general availability. We will share a summary with customers.
Security questionnaires. We can complete your security questionnaire and sign a mutual NDA. Email hello@workfloor.com.au.
Found a security issue?
Please email hello@workfloor.com.au with the details. Please don’t include customer or employee data in the report.