Your electronic onboarding is safe and secure with WorkBright
Protected. Monitored. Restorable.
Data protection standards used by Top-Tier financial institutions.
HR data should always be kept confidential. That’s why we focus fastidiously on protecting our customer’s data. To that end, we have built and implemented many of the same security and privacy controls used by top-tier financial institutions. On top of that, we regularly re-evaluate and test our security measures to ensure we align with industry standards & best practices.
ENCRYPTION
Data transmitted between your browser and our application is encrypted using bank-grade 256-bit SSL certificates.
Sensitive data stored in our database is encrypted using bank-grade 256-bit AES encryption.
Account passwords are stored using one-way encryption so they can never be accessed in plain text (even by us).
Each customers’ data is sandboxed in a unique, protected database environment.
APP & SYSTEMS SECURITY
We stay up-to-date on security patches and fixes from our vendors.
We follow industry best practices against man-in-the-middle attacks, injection attacks, and cross-site request forgery.
Only individually-authorized computers (such as those from our Engineering Team) can access our production servers.
We implement strict firewall and authentication rules on all of our production machines.
DATA BACKUP
Production data is automatically and continuously backed up to multiple, separate locations.
We maintain daily backup records for the last 2 weeks of time, while our database enables us to perform point-in-time recovery.
Backup data is protected using the same safeguards we employ for our regular production environment.
We maintain comprehensive audit logs covering all customer and user transactions, systems access, and network operations.
Passwords, social security numbers, and other sensitive information are automatically stripped out from log files and audit records.
We monitor our infrastructure 24×7 using a combination of third-party monitoring services and in-house tools.
Operational Security
Vendor Restricted
Our application is built and maintained entirely in-house by our core Engineering Team. Outside vendors never have access to any part of our code, databases, or application infrastructure.
Engineer Exclusive
Database and server access is restricted to Engineering Team members on a strict need-to-know basis.
Client Aligned
We trust our own sensitive HR information to our application, making sure our security and privacy priorities never become misaligned with our customers’.
Multi-Factor Authentication
What is it?
An optional security enhancement requiring administrators to verify their identity using a secondary device in addition to knowing their password .
Why Use it?
Adds an additional layer of security between your administrators and access to the personally identifiable information of your employees
What is SOC2 Type 2 Compliance? – What this means for you
WorkBright is SOC 2 Type II certified which guarantees that a data processor will handle your company’s private details properly. In basic terms, it’s an auditing procedure that ensures your data is properly managed.
What is the difference between Type I and Type II? A SOC 2 Type 1 is an audit done at a point in time, Type 2 is audit done over the entire year.
While a SOC 1 audit from your vendor helps provide your management with assurances regarding vendor controls that are likely to be relevant to an audit of your financial statements, the SOC 2 audit provides additional assurances regarding vendor controls that relate to operations and compliance relevant to one or more of the following five principles: security, availability, processing integrity, confidentiality, and privacy.
