Security at WorkSpan

Access to your data is defined by attribute based access controls—allowing users, owners, and admins to have fine grained application access control far more advanced than traditional role based applications security models.

Data is stringently protected via encryption:

• Data in flight is secured via 128 bit TLS 1.2 using AES_128_GCM with ECDHE_RSA key exchange.
• For Data at rest, each cloud storage object’s data and metadata is encrypted under the 256-bit Advanced Encryption Standard (AES-256).

WorkSpan policies for its internal employees ensure safe and compliant handling of user data.

Application data related to company’s use of information is subject to company’s data retention policies. Data can be permanently deleted at user or company request. User’s personal data is removed after user is no longer part of WorkSpan.

Absolutely. You can access the WorkSpan application from anywhere in the world with secure credentials.

With WorkSpan, you can easily enforce your company’s data privacy and access policy uniformly across all partner facing teams. You can share the data at a record level, and further restrict access at a field level in a shared record:

• Record Level: Selectively share specific records with your partner companies, specific users in the partner companies, or within your company.
• Field Level: WorkSpan’s extensible architecture enables you to add shared and private fields. Private fields are only viewable to people in your own company. Shared fields allow you to share the data with your partner teams.

We maintain the current list of all of our sub-processors at Workspan's Sub-Processor Repository Page.

Yes, WorkSpan’s Chief Information Security Officer, Milind Joshi, is our data protection officer and responsible for GDPR compliance.

Customer data is stored in secure enterprise-grade public clouds such as Google Cloud, Microsoft Azure, and Amazon Web Services.

WorkSpan provides three modes for sharing: Owner Mode, Partner Mode, and Network Mode. These modes are set at a record level. Only Owners can set the sharing mode.

• Owner Mode: Most restrictive mode, where only the owner can share the data.
  • Example: Only the owner can add new users or companies, and set the company flags for employees to find and request to join.
• Partner Mode: Delegate the sharing to other member users, facilitating seamless collaboration.
  • Example:All members can share with new users and companies. However, they can only grant access level equivalent to or below the access level that the member has.
• Network Mode: Broadcast to all companies on the network.
  • Example: All members can share with new users and companies. However, they can only grant access level equivalent to or below the access level that the member has. In addition, any user from any company on the WorkSpan Network can discover and request to join.

We process personal data to operate, improve, understand, and personalize our services. For example, we may use personal data to:

• Create and manage user profiles
• Communicate with you about the services
• Enable communication and collaboration between users of the services
• Contact you about service announcements, updates, or offers
• Provide support and assistance for the services
• Provide your employer or sponsoring organization with information about your usage of the services
• Personalize content and communications based on your preferences
• Meet contract or legal obligations
• Respond to user inquiries
• Fulfill user requests
• Comply with our legal or contractual obligations
• Resolve disputes
• Protect against or deter fraudulent, illegal, or harmful actions
• Enforce our Terms of Service

Yes, WorkSpan provides a privacy statement. Please find a copy here

Yes, WorkSpan provides a user agreement. Please find a copy here

In your WorkSpan instance, navigate to the strategy tab on the Programs page. At the bottom of this page, you can find the program policy documents. Similarly, the Campaigns tab has a section at the bottom of the page containing program policy documents for that particular program.

Yes, information security risk assessment is performed annually and after every major change. Risk assessment is presented to the leadership team for discussion and action.

Yes. An existing user can be removed from every WorkSpan object with a single click. It’s just as quick and easy to remove a user as it is to replace an existing user with another in the system.

WorkSpan collects personal data about you when you provide such information directly to us, when third parties such as our business partners or service providers provide us with personal information about you, or when personal data about you is automatically collected in connection with your use of our services. WorkSpan applications use your:

• Name (required)
• Work email address (required)
• Profile picture (optional)
• User added content (which may include personal data if you include personal data in such content)

In addition, via the WorkSpan website, if you sign up for a newsletter, event, webinar, etc. you may volunteer to provide telephone and physical address as needed.

No special, sensitive data (e.g. race, ethnicity, gender, trade union, health, sexual preference), or criminal convictions are ever captured on WorkSpan.

Yes, WorkSpan treats security and privacy as a top priority and conducts awareness training for employees and contractors annually and upon hire.

WorkSpan monitors services availability and capacity in real-time, and auto provisions for higher availability for peak performance and failover.

Absolutely. WorkSpan has an “always on” audit trail that gives you accurate and reliable information at all times of who did what and when in the system.