WorkplaceYou
Trust Center

How WorkplaceYou protects report data

See the product and operational controls currently used to protect WorkplaceYou reports, along with the assurance work that continues as the service evolves.

Last application review: August 2026 Public access enabled
Implemented

Access control and tenant isolation

Employer access is resolved from the authenticated user, their organization, role, report-type permissions, and relationship to the report.

See control details
  • Backend authorization is authoritative for report views, reporting data, settings, exports, and destructive actions.
  • Organization identifiers supplied by a browser are checked against trusted account and report records.
  • Inactive accounts and cross-organization requests are denied.
Implemented

Employee privacy and report access

Employee access to an existing report uses a report-bound, time-limited session rather than ordinary employer-user access.

See control details
  • Session credentials are stored as one-way digests and are not placed in page addresses.
  • Employee sessions are bound to one report and expire after inactivity and at an absolute time limit.
  • Unavailable and nonexistent reports use privacy-preserving responses designed to avoid report enumeration.
Implemented

Private attachments and file safety

Report attachments use private storage, controlled access, quarantine, and file-safety review.

See control details
  • Attachment metadata and access decisions are backend controlled.
  • Files remain unavailable until they receive an acceptable scan result.
  • Rejected or inconclusive files remain unavailable and are handled through controlled cleanup and retry workflows.
Implemented

Auditability and record integrity

Material report actions are recorded in protected audit records with actor, time, report, and change context.

See control details
  • The primary report audit ledger is append-only in application behavior and unavailable for direct client changes.
  • Sensitive audit data is separated from ordinary user-facing history.
  • Critical workflows use operation identifiers and idempotency controls to reduce duplicate or contradictory records.
Implemented

Messaging and notifications

Message access and alert delivery follow the recipient’s authorized relationship to the report.

See control details
  • Employee and employer read states are recorded separately.
  • Notification delivery uses durable work records and controlled retries.
  • Employee email alerts are intentionally excluded from the employer-facing alert log to protect reporter privacy.
Implemented with human review

AI safeguards

AI features support employees and authorized employer users; they do not replace employer judgment or authorization.

See control details
  • Employees must opt in before Clarifying Questions are generated, may answer or skip each question, and can continue without them.
  • Employer SuperUsers can disable Clarifying Questions, with backend enforcement when the intake feature is disabled.
  • AI does not replace or rewrite the employee’s original statement, decide outcomes, change report status, or take action on a report.
  • Employer-facing AI uses only information the authorized user is permitted to access within their organization.
  • AI requests do not use open-internet context in the application’s general AI helper, and customer data is not used to train external AI models.
  • Generated observations, drafts, and insights remain reviewable supporting material, not automated employment decisions.
Implemented controls

Retention, deletion, and legal preservation

WorkplaceYou supports reversible archive, controlled removal from the active service, and platform Legal Preservation Holds.

See control details
  • Deletion is restricted to authorized employer SuperUsers and requires an acknowledgment and reason.
  • An active report or organization preservation hold blocks deletion through backend enforcement.
  • Successful deletion removes report content from the active service and leaves a minimal certificate without report narrative, reporter identity, messages, notes, or attachments.
  • Encrypted copies may remain in isolated disaster-recovery backups after deletion; they are unavailable through ordinary access and excluded from normal restoration. Recovery objects are protected for at least 30 days while lifecycle limits for eventual removal are finalized.
Implemented with ongoing assurance

Independent backup and disaster recovery

WorkplaceYou maintains a private Cloudflare R2 recovery layer that is separate from the primary Base44 application environment.

See control details
  • A scheduled nightly process exports critical structured application data into compressed, independently stored recovery objects.
  • Clean report attachments are copied into the recovery bucket and later backups verify protected copies rather than silently assuming they remain available.
  • Each exported data set and protected attachment is checked by size and SHA-256 checksum, and every run produces a separately verified manifest and durable run record.
  • Recovery objects are protected from deletion or overwrite for at least 30 days through a Cloudflare bucket-lock rule; a controlled lifecycle schedule is being finalized.
  • Restoration is performed through a controlled recovery process into an isolated environment. Independent later-download testing, code and schema protection, and automated restore tooling remain ongoing assurance work.

How to read this page

Current safeguards, explained plainly

These controls reflect the current WorkplaceYou application and operating practices. We update this page as safeguards, service providers, and procedures change.

Security questions or responsible disclosure

Contact us with security, privacy, procurement, or responsible-disclosure questions. Do not include employee report content or credentials in email.

hello@workplaceyou.com