WorkHands requires the minimum information to get your apprentices started. For example, see our typical import template.

WorkHands encrypts data in transit with TLS and uses encryption technologies to protect customer data at rest. Backups are encrypted as well.

Yes. All WorkHands employees and contractors go through background checks with Checkr and are covered by confidentiality agreements. New hires complete security awareness training as part of onboarding and at least annually thereafter.

The WorkHands web application runs on Amazon Web Services (AWS), including segregated VPC networking, load balancing, and encrypted storage. Physical and environmental security of data centers is managed by AWS; WorkHands reviews AWS attestation reports at least annually.

WorkHands production systems and customer data are hosted on Amazon Web Services in the United States (us-west-2).

WorkHands maintains a SOC 2 Type II report covering the Security Trust Services Criteria, independently examined by Johanson LLP. We also use continuous compliance monitoring (including Vanta) to track control adherence over time.

Prospective and current customers can request our latest SOC 2 Type II report under NDA. Contact us and a member of our team will share the report and walk through any follow-up questions.

Access to production systems is limited to authorized WorkHands operations personnel, provisioned based on role, and protected with WorkHands-administered single sign-on. Customer data access inside the product follows least-privilege permissions for each program role.

WorkHands maintains an incident response plan for identifying, reporting, and responding to security or privacy incidents, including notification procedures when a breach or other incident requires customer notice.

Customer data is backed up in AWS. Backups are encrypted, monitored for completion, and restricted to key personnel. WorkHands maintains procedures for recovery if a backup job fails.

WorkHands continuously monitors its codebase for known vulnerabilities (including Dependabot) and maintains an internal SLA for remediation. We also perform regular vulnerability scanning and annual independent penetration testing of the production environment.

Our Privacy Policy explains what we collect, how we use it, and customer choices. For enterprise procurement questionnaires, contact us and we can walk through privacy and data-handling practices with your team.

WorkHands uses carefully selected subprocessors to help deliver the platform. Our primary infrastructure subprocessor is Amazon Web Services. A current subprocessors list is available to customers on request.

If you believe you have found a security vulnerability in WorkHands, please email our security team. We review reports and work to remediate confirmed issues according to our internal SLAs.

We'll connect you with a member of our team who can speak to our security protocols.