Architecture and security, by the receipt.

Real-time replication. Workzoom uses real-time replication for client data across different AWS Availability Zones with a minimum distance of 100 km between the primary and replica, to mitigate environmental and infrastructure-related failures.

Daily encrypted backups, off-site. Encrypted backups are taken daily and stored securely off-site at a minimum distance of 100 km from the primary server locations. More frequent backup options are available based on client requirements. The last 5 backups are also retained on-site.

Recovery posture. In the event of an incident or server failure, clients are switched to the replication environment. In the worst case, data is recovered from the last daily backup. Because Workzoom application servers use intelligent clustering across multiple Availability Zones at all times, no application downtime occurs in the event of a single-data-center incident. In the event of a major incident: maximum data exposure 24 hours; recovery time normally between 5 minutes and 8 hours, depending on the size and volume of restoration required.

Role-based access control, down to the field

Workzoom is primarily role-based. Because the platform is built around HR, every user has a pre-defined role and responsibilities built into their job and position definition. The same role definition drives security: a user's role defines exactly what data they can view, add, update, or remove. When an exception is required, security can be applied at the individual user or group level, down to a single field if necessary.

Workzoom controls four dimensions of access independently:

Activity logging compliant with Sarbanes-Oxley

All logins and session activities are logged. For every login, action, or change, the application records the user, the process, the timestamp, the IP address, the original value, and the new value. Logging procedures are compliant with Sarbanes-Oxley requirements.

Workzoom staff access to client data

Access to client data is restricted to individuals who support the client. Every Workzoom employee signs a non-disclosure agreement and a code of ethics and is subject to background and criminal record checks as part of the new-hire process.

All Workzoom servers are isolated on their own VPC. Access to Workzoom servers is available only to a very limited set of authorized personnel, only through a VPN tunnel with TLS 1.2 ciphers and SHA-256 key exchange, with AES-256 encryption of all data inside the tunnel. Web consoles and administrator accounts require multi-factor authentication using rotating access tokens. All VPN connection data is logged, and alerts fire on failed authentication attempts. All client data is securely removed from the cloud and from internal computers at the end of every engagement.

Clients may conduct penetration tests and vulnerability assessments against Workzoom, either internally or through a third-party security firm, with Workzoom's prior approval. The policy:

• 14 days advance notice of any testing, with a detailed outline of testing procedures and schedule.
• Signed NDA from all parties involved before testing begins.
• Un-redacted results related to Workzoom technologies provided within 7 days of testing completion.
• Workzoom reserves the right to restrict testing scope, timing, methodology, or supplier where necessary to protect other clients in the multi-tenant environment.

Submit a pen test request to security@workzoom.com with the testing window, scope, and the firm performing the assessment.