Security & Compliance at Workerbase

We’re compliant with the highest security and privacy standards

Workerbase undergoes regular audits by independent external auditors for compliance with GDPR and CCPA privacy regulations. Our adherence to GDPR and CCPA demonstrates our dedication to safeguarding personal information and implementing a consent-based approach to processing personal data.

Our encryption protocols are national-security worthy

Leveraging a multi-cloud environment, Workerbase ensures all data is encrypted, both at rest and in transit, utilizing top-tier security algorithms such as RSA4096, SHA256, and AES256. We employ Transport Layer Security (TLS) to encrypt data sent to or from our infrastructure, adhering to industry best practices. All stored data benefits from robust encryption algorithms and is secured with advanced secret management services. You can access our SSLLabs report here.

Workerbase provides comprehensive encryption throughout every phase—whether data is at rest, in transit, or stored in the cloud, ensuring maximum security, privacy, and integrity. Additionally, even metadata communications between your system and Workerbase are fully encrypted for complete protection.

Our consent-based model gives people control over their personal and protected health information 

Under the General Data Protection Regulation (GDPR) established in 2018 in Europe, individuals own their personal data, including protected health data, and any consent to process or share this data must be “freely given, specific, and informed.” We fully support this principle.

When a user utilizes Workerbase services, they effectively request permission from an individual to access their data. This process empowers people to exercise their rights to consent and ownership of their data.

Our security measures are ever evolving to keep pace with the changing threat landscape

Our commitment to security and privacy is ongoing, involving a perpetual cycle of research, revision, implementation, testing, correction, scaling, safeguarding, and granting permissions. We are dedicated to consistently meeting and surpassing the expectations of regulators, investors, partners, and users. Our team lives and breathes security processes every day, making them a fundamental part of our culture. After all, security is one of the core services we provide.

Data retention and removal is standardized and at the discretion of our users 

All permissioned user data held by Workerbase is available to our customers for electronic retrieval for a period of 30 days after the expiration or termination of the Master Service Agreement. All data is then completely removed from Workerbase’s servers. Every user can request the removal of their personal data by contacting Workerbase support. Read more about our privacy settings.

We establish strong defenses at points of entry 

Workerbase has designed apps and backend infrastructure, which are the primary gateways for user data, to only accept client requests through robust TLS protocols. Furthermore, all data transmissions between Workerbase-managed infrastructure and data platforms occur over encrypted tunnels.

We take all necessary infrastructure precautions. 

All of our services run in cloud environments. We don’t host or run our own routers, load balancers, DNS servers, or physical servers. Cloud providers we use regularly undergo independent verification of security, privacy, and compliance controls against the following standards: ISO/IEC 27001, ISO/IEC 27017, SOC 1, SOC 2, SOC 3, PCI DSS, HIPAA, CSA Star, FedRAMP, and many others.

Secure code: transparent development with security in mind 

Protecting customer data from modern threats means products developed through our services must be developed with security in mind. The following practices ensure the highest level of security in our software:

  • Applying Secure Software Development Life Cycle (S-SDLC) which focuses on incorporating security into the development cycle
  • Developing and continuously maintaining a corporate culture dedicated to security
  • We assess the security of our code using industry well-known security frameworks such as ATT&CK, OWASP Top 10, and SANS Top 25
  • Developers participate in regular security training to learn about common vulnerabilities, threats and secure coding best practices
  • We review our code for security vulnerabilities
  • We regularly update our backend infrastructure and software and make sure none of them have known vulnerabilities
  • We use static application security testing (SAST) and dynamic application security testing (DAST) to detect basic security vulnerabilities in our codebase
  • We conduct regular external penetration tests on our production environments

 
Our application security monitoring and protections solutions allow us the visibility to:

  • Identify attacks and respond quickly to a data breach
  • Monitor exceptions and logs and detect anomalies in our applications
  • Collect and store logs to provide an audit trail of our applications activity

 
We also deploy a runtime protection system that identifies and blocks web attacks and business logic attacks in real time, as well as security headers to protect our users from attacks.

We practice stringent network-level security monitoring and protection 

We maintain our own in-house Security Operations Center. Our network consists of multiple security zones, which we monitor and protect with trusted and next-generation firewalls, including IP address filtering, to insure against unauthorized access. We deploy an intrusion detection and/or prevention solution (IDS/IPS) that monitors and blocks potential malicious packets as well as distributed denial of service (DDoS) mitigation services powered by an industry-leading solution.

We boast an industry-leading security team 

Our security team comprises security experts dedicated to constantly improving the security of our organization. Our team is trained and certified in security threat detection and incident response, security engineering, penetration testing, application security, security management compliance and latest security best practices.

We encourage responsible disclosure. 

If you discover vulnerabilities in our application or infrastructure, we ask that you alert our team by contacting infosec@workerbase.com please include a proof of concept in your email. We will respond as quickly as possible to your submission and won’t take legal action if you follow the responsible disclosure process:

  • Please avoid automated testing and only perform security tests with your own data
  • Please include a proof of concept in your email
  • Do not disclose any information regarding the vulnerabilities until clear approval is given

 
Note that our bug bounty program is currently closed and we are not looking for new security researchers.

General Information Security Policy 

Protect the Company’s informational and IT assets (including but not limited to all computers, mobile devices, networking equipment, software, and sensitive data) against all internal, external, deliberate, or accidental threats and to mitigate the risks associated with the theft, loss, misuse, damage or abuse of these systems;

Ensure information will be protected against any unauthorized access. Users shall only have access to resources that they have been specifically authorized to access. The allocation of privileges shall be strictly controlled and reviewed regularly.

Protect CONFIDENTIALITY of information. When we talk about confidentiality of information, we are talking about protecting the information from disclosure to unauthorized parties;

Ensure INTEGRITY of information. Integrity of information refers to protecting information from being modified by unauthorized parties;

Maintain AVAILABILITY of information for business processes. Availability of information refers to ensuring that authorized parties can access the information when needed.

Comply with and, wherever possible, exceed, national legislative and regulatory requirements, standards, and best practices;

Develop, Maintain and Test business continuity plans to ensure we stay on course despite all obstacles that we may come across. It is about “keeping calm and carrying on!”;

Raise awareness of information security by making information security training available for all Employees. Security awareness and targeted training shall be conducted consistently, security responsibilities reflected in job descriptions, and compliance with security requirements shall be expected and accepted as a part of our culture;

Ensure that no action will be taken against any employee who discloses an information security concern through reporting or in direct contact with Information Security Management Leader, unless such disclosure indicates, beyond any reasonable doubt, an illegal act, gross negligence, or a repetitive deliberate or willful disregard for regulations or procedures;

Report all actual or suspected information security breaches to infosec@workerbase.com