Security and data handling
All data in Workfolio is encrypted and stored securely following industry best practices.
Where data is kept
Workfolio is hosted on Amazon Web Services. Screenshots are uploaded directly to Amazon S3, not through Workfolio's servers.
Workfolio is operated from the United States. Information is transferred to, processed, and accessed in the United States or another country where Workfolio or its service providers operate.
How data is protected
All data to and from Workfolio is sent over HTTPS. All data in Workfolio is encrypted and stored securely following industry best practices.
Workfolio does not record what is typed, only whether the keyboard is active or inactive.
Who can see data
A company's admin sees its whole company's tracking data, a team head sees the team's, and a team member sees only their own. No one outside the company can see it.
Staff access
Access to customer information and systems is restricted to authorized personnel based on business need.
Security practices
- Multi-factor authentication
- Penetration testing, with identified issues reviewed and addressed
- Annual security risk assessments
- Security awareness training for employees
- Server access only by authorized personnel, with SSH keys, over a VPN, and two-factor authentication on server systems
- Processes for identifying, investigating, and responding to security incidents
How long data is kept
- Basic: Last 14 days data retention; 10 GB file storage limit
- Pro: Last 1 year data retention; Unlimited Storage; Last 3 months screenshot retention
Deletion and backups
A screenshot you delete is deleted at once from active systems, and no backup copy of deleted data is kept.
Workfolio keeps multiple backups for infrastructure disaster recovery and cannot offer backup of one account against user-made errors.
After an account is closed, Workfolio may keep its information and content for a commercially reasonable time for backup, archival, and audit purposes.
Terms
Workfolio maintains appropriate technical and organizational measures to protect customer data, and notifies the customer without undue delay after becoming aware of a data incident affecting it.
Data protection roles
Under the Terms Of Service, the customer is the controller and Workfolio is the processor of personal data processed in the service.
HIPAA
For protected health information and business associate agreements, read Workfolio HIPAA Compliance & Security.
Questions
Write to team@getworkfolio.com.