Enterprise-grade security,
built in from day one
Your employees' skill data is some of the most sensitive information in your organization. We treat it that way.
Every customer is a separate tenant
WorkRedesign uses hard multi-tenancy: each customer's data lives in an isolated database schema with a dedicated encryption key. There is no shared data layer between tenants - a query from one customer's environment can never reach another's rows.
Tenant identifiers are enforced at the application layer, the database layer, and the API gateway. A misconfigured query that drops a tenant filter returns zero rows rather than another customer's data.
Isolated schemas
Each tenant has a dedicated PostgreSQL schema. Cross-schema queries are blocked by policy at the database role level.
Per-tenant encryption keys
Unique AES-256 keys per tenant, rotated annually. Master keys stored in AWS KMS with hardware-backed HSMs.
Network isolation
Each tenant environment runs in a dedicated VPC subnet. Lateral movement between tenant networks is blocked at the security group level.
Separate audit logs
Audit trails are tenant-scoped and write-only for the customer. WorkRedesign support staff cannot modify or delete them.
Encrypted everywhere, always
All data is encrypted at rest using AES-256 and in transit using TLS 1.3. We do not support TLS 1.1 or 1.2. Internal service-to-service communication is mutually authenticated with short-lived certificates issued by our internal CA.
Least privilege, everywhere
Access to WorkRedesign is governed by role-based access control (RBAC) with four roles: Viewer, Analyst, HR Admin, and Org Admin. Permissions are additive and explicit - no role inherits access it wasn't granted.
WorkRedesign staff access to customer environments requires a time-limited break-glass authorization, logged to an immutable audit trail, and reviewed weekly. No engineer has standing access to production customer data.
RBAC with 4 roles
Viewer, Analyst, HR Admin, Org Admin. Roles are scoped to org, function, or team level.
SSO / SAML 2.0
Integrate with your IdP (Okta, Azure AD, Google Workspace). MFA enforced for all admin roles.
Session management
Sessions expire after 8 hours of inactivity. All active sessions are visible and revocable from the admin console.
API key scoping
API keys are scoped to specific resources and operations. Keys are never logged in plaintext and can be rotated instantly.
Frameworks and certifications
We maintain certifications and controls that enterprise procurement teams require. Our SOC 2 Type II report is available to customers and prospects under NDA.
| Framework | Status | Scope |
|---|---|---|
| SOC 2 Type II | Certified | Security, Availability, Confidentiality trust service criteria |
| GDPR | Compliant | Data processing agreements, DPO appointed, EU data residency available |
| CCPA | Compliant | Consumer rights requests, deletion workflows, data inventory maintained |
| ISO 27001 | In progress | Audit scheduled Q2 2026 |
| HIPAA | On roadmap | Available as Enterprise add-on for healthcare customers |
Built on hardened cloud infrastructure
WorkRedesign runs on AWS in a multi-region active-passive configuration. Primary region is eu-west-1 (Ireland) with a failover region in us-east-1. Enterprise customers can request single-region deployment within a specific geography or private cloud / on-premises deployment.
We run infrastructure-as-code with immutable deployments. No direct SSH access to production hosts. All changes go through a reviewed CI/CD pipeline with automated security scanning at every step.
Multi-region failover
Automatic failover with RPO < 1 hour and RTO < 4 hours. 99.9% uptime SLA on Enterprise tier.
Immutable deployments
Every deployment is a new immutable artifact. Rollback takes under 3 minutes. No in-place mutations to running hosts.
Continuous vulnerability scanning
Container images scanned on every build. SAST and dependency scanning in CI. Critical CVEs patched within 48 hours.
Penetration testing
Annual third-party penetration test by a CREST-certified firm. Results reviewed by our security team and tracked to remediation.
Your data is yours - unconditionally
WorkRedesign is a data processor, not a data controller. Your organization retains full ownership of all employee skill data. We process it on your behalf, under your instructions, and we return or delete it on request.
We never use customer data to train our models. Reconciliation logic improvements are derived from anonymized, aggregated conflict patterns - never from identifiable employee records. This commitment is contractual, not just a policy.
On contract termination, your data is exported in full (JSON or CSV) within 5 business days. After export confirmation, all customer data is deleted within 30 days and deletion is certified in writing.
When something goes wrong, we move fast
We maintain a documented incident response plan with defined severity levels, escalation paths, and notification SLAs. Our security team is on call 24/7.
In the event of a confirmed data breach affecting your tenant, we will notify your designated security contact within 72 hours of detection - meeting GDPR Article 33 requirements - and provide a full post-incident report within 14 days. Enterprise customers receive a dedicated incident communication channel.
Severity-based response
P0 (data breach) - 1hr response, immediate exec escalation. P1 (service impact) - 4hr response. P2/P3 - next business day.
Customer notification
Affected customers notified within 72 hours of a confirmed breach. Status page updated in real time for service incidents.
We welcome responsible disclosure
If you discover a security vulnerability in WorkRedesign, please report it to us before disclosing it publicly. We commit to acknowledging your report within 2 business days and keeping you informed of progress.
Contact our security team
Send vulnerability reports to security@workredesign.org. Please encrypt sensitive details using our PGP public key. We do not operate a paid bug bounty program at this time, but we will publicly acknowledge researchers who report valid issues if they wish.
We ask that you do not access, modify, or delete customer data during testing; do not perform denial-of-service testing; and give us reasonable time to fix confirmed issues before public disclosure.
Questions about our
security posture?
Our security team responds to enterprise security questionnaires and can provide our SOC 2 report under NDA.