Trust & Security

Security & Trust

How we protect your data. Last updated: August 2026

Our commitment

Workplacer Sweden AB builds workplace-intelligence software for enterprise real estate teams. Protecting the data our customers entrust to us is fundamental to how we operate. This page summarises our security and data-protection posture; our Data Processing Agreement and Privacy Policy set out the detail.

Data hosting & residency

Workplacer is a cloud-native platform. Customer data at rest — the application database, uploaded files, and error telemetry — is hosted within the European Union (Frankfurt, Germany) on established managed infrastructure (Vercel and Neon, running on AWS).

We do not operate our own data centres. Cross-border transfer is the exception rather than the norm, limited to specific AI and supporting functions and governed by EU Standard Contractual Clauses.

Encryption

Data encrypted in transit using TLS 1.3.
Data encrypted at rest using AES-256.

Data protection & privacy

We are an EU-established company and process personal data in accordance with the GDPR.

Data subject rights (access, portability, rectification, erasure) supported through self-service tools and on request.
A published data retention schedule; data is deleted or anonymised on account termination or erasure request.
Multi-tenant isolation — every data access is scoped to the owning company and enforced server-side.
Personal data is minimised and automatically scrubbed before any AI processing.

Privacy by design

Privacy is built into how the platform is designed, built, and operated — not added afterwards — following the seven foundational privacy-by-design principles.

Preventative: privacy risks are caught in design and code — tenant isolation is enforced at the data-query layer and automated audits flag any unscoped query on every change.
Privacy as default: isolation, encryption, and no-training-on-customer-data are always on; customers can further restrict or disable AI access to their data.
Embedded: data export, erasure, retention, and PII redaction are first-class product features, not add-ons.
Transparent and user-centric: practices are openly documented, and customers own their data and control its lifecycle.

Access control & authentication

Role-based access control with least-privilege permissions, scoped by company, site, and project.
Single sign-on via SAML 2.0 and OIDC, with each customer able to connect its own identity provider.
Multi-factor authentication on administrative and infrastructure accounts.
Immediate revocation of access when a person leaves, including session invalidation.

Security program

We operate a continuous information security program covering the identification, assessment, treatment, and monitoring of risk.

Automated dependency scanning with daily security-advisory monitoring, and defined remediation timeframes.
A secure development lifecycle — every change is reviewed and must pass automated checks before deployment.
Real-time production monitoring, an immutable audit log, and rate limiting on sensitive endpoints.
Encryption, tenant isolation, and centralised secret management enforced throughout.

Business continuity & recovery

Our serverless architecture provides high availability and rapid recovery by design.

Continuous database backup with point-in-time recovery.
Automated resilience — edge failover, multi-availability-zone redundancy, and zero-downtime deployments with instant rollback.
Defined recovery objectives: a near-zero recovery point objective, with tiered recovery time objectives.

Subprocessors & international transfers

We use a small set of established subprocessors for infrastructure, AI, communication, and monitoring. Each is bound by a data processing agreement, and any transfer of personal data outside the EU is governed by the European Commission's current Standard Contractual Clauses. The authoritative subprocessor list is maintained in our Data Processing Agreement.

Responsible AI

AI features are governed across their lifecycle. Our controls include:

Customer data is not used to train third-party AI models.
Personal data is scrubbed before it is sent for AI processing.
Each customer controls how much document content the AI may access, and can disable AI entirely.
AI outputs support human decision-making and are scoped to the requesting company's data.

Incident response

We maintain a defined breach-notification process. In the event of a personal data breach affecting customer data, we notify affected customers without undue delay and no later than 72 hours after becoming aware, in line with GDPR Article 33, followed by a root-cause report.

Certifications

Our controls are aligned with the principles of ISO 27001 and SOC 2, and our core infrastructure providers maintain their own ISO 27001 and SOC 2 certifications. Formal certification of Workplacer is on our roadmap as the business scales. We welcome customer-led security reviews under NDA.

Security questionnaire — the answers in full

Everything a vendor security questionnaire asks, answered here rather than on request. Where the answer is no — certifications, most obviously — it says no, with what we do instead.

Certifications

Does your company have a current ISO 27001 certification?

No. Workplacer is not currently ISO 27001 certified. We operate a continuous security program aligned with recognised framework principles, and our core infrastructure subprocessors (AWS, Vercel, Neon) maintain their own ISO 27001 / SOC 2 certifications. Formal certification is planned as the business scales.

SOC 2

Does your company have a current SOC 2 Type 2 report?

No. Not currently certified. SOC 2 is planned as the business scales; our core infrastructure subprocessors maintain their own SOC 2 / ISO 27001 attestations.

Policies & privacy

How often do you review your policies?

Annually. Security and data-protection policies are reviewed at least annually, and additionally whenever there is a significant change to the platform, architecture, subprocessors, or applicable law.

Are you compliant with the privacy legislation of the country you operate in?

Yes. Workplacer is established in the EU (Sweden) and operates in compliance with the GDPR and applicable Swedish data protection law. Measures include a published DPA and Privacy Policy, lawful-basis and data-minimisation practices, data subject rights handling, EU data residency, EU Standard Contractual Clauses for non-EU subprocessors, a GDPR Article 33 breach-notification process, and a maintained subprocessor list. As an EU-established company we comply with the GDPR directly; the EU-U.S. Data Privacy Framework self-certification is a mechanism for US-based data importers and is not applicable to us.

Do you support SAML for single sign-on?

Yes. We support SAML 2.0 (and OIDC) for single sign-on, configured per customer organisation, with each company able to connect its own identity provider. SSO authenticates invited users rather than auto-provisioning new accounts, keeping access under the customer administrator's control.

Data categories, retention & deletion

What categories of personal data do you hold, transfer, or process on our behalf?

Account/login data for platform users (full name, email address, functional role/job title) and location-related data (office/site work locations, IP addresses in session/audit logs, and aggregated employee home-origin postcodes stored as headcount aggregates, not named individuals). Employee data is otherwise stored as aggregate headcount by department and site — we do not maintain a named per-employee register. Employee survey responses are collected anonymously (no name, email, or unique per-respondent link). Because the platform accepts free-text notes and document uploads, a customer may enter additional personal data into those fields. We do not hold date of birth, home addresses, phone numbers, payment-card or bank details, or personal health information as structured data.

For how long is this data retained?

All personal data processed on the customer's behalf is retained for the lifetime of the customer account, then deleted or anonymized on termination or on an erasure request (with a 30-day post-termination extraction window). Authentication sessions expire after 7 days; audit logs are retained for the account lifetime by default or a shorter customer-configured period; database backups roll on a 7-day point-in-time-recovery window. Full detail is in the attached Data Retention Schedule.

Do you have a published data retention schedule?

Yes. A Data Retention Schedule defining retention periods per data category is provided in this package and governed by our Privacy Policy (§7) and DPA (§13).

What processes and methods are you using to properly delete data?

Deletion hard-deletes records from the live PostgreSQL database, with referential cascades removing all dependent records so no orphaned personal data remains. Uploaded files are removed from object storage together with their owning record. Where records must be retained for audit or legal integrity, personal identifiers are anonymized rather than kept. Deleted data ages out of the 7-day encrypted backup window and is not restored to live service outside a documented recovery event. All data is encrypted at rest (AES-256) and in transit (TLS 1.3). Deletion can be initiated by the data subject (self-service), by an administrator, or automatically via scheduled retention jobs.

What type of data center are you using?

Cloud. Workplacer runs entirely on managed cloud infrastructure — no on-premises hardware and no hybrid deployment.

Who manages the data center and where is it located?

Workplacer does not operate its own data center. Application hosting and compute are managed by Vercel, and the primary database by Neon — both running on Amazon Web Services (AWS), region `eu-central-1` (Frankfurt, Germany). Application compute is region-pinned to Frankfurt; the database, file storage, and error monitoring reside in the EU. A number of AI, mapping, and authentication subprocessors process limited data in the US under Standard Contractual Clauses; the full list is in our DPA.

Security governance

Is there an information security risk management process in place?

Yes. A continuous process covering identification, assessment/prioritization, treatment, and monitoring, with severity-based remediation SLAs and daily posture review across error tracking, audit logs, and dependency advisories. See the attached Information Security Risk Management summary.

Are external devices allowed?

Yes (not centrally blocked). Customer data is cloud-hosted and not stored in bulk on local endpoints. Work is performed on company-controlled machines with built-in, always-on endpoint protection and full-disk encryption (FileVault) enabled; external/removable storage is not used in connection with customer data.

Do you have a business continuity and disaster recovery plan in place?

Yes. See the attached Business Continuity & Disaster Recovery Plan — architecture resilience, continuous backup with 7-day point-in-time recovery, defined disaster scenarios with recovery steps, and recovery objectives.

How often is the plan tested?

Other. Formal scheduled DR test drills are being established; we do not yet have a completed formal test report to attach. Automated resilience mechanisms (edge failover, database multi-AZ redundancy, point-in-time recovery, background-job retries) operate continuously. The documented recovery procedures and target testing cadence are set out in the BCP/DR Plan.

Do you have established RTO and RPO?

Yes. RPO: near zero (continuous backup with point-in-time recovery). RTO (technical recovery time once engineering has engaged): application < 15 minutes, database < 1 hour, full region failover < 4 hours.

Is a Business Impact Analysis (BIA) performed?

No formal standalone BIA. The impact and criticality reasoning it produces is reflected in our BCP/DR Plan (critical components identified; differentiated recovery objectives). A formal BIA will be introduced as our continuity program matures.

How often is the BIA reviewed/updated?

Only when significant changes occur. The impact/criticality reasoning underpinning our recovery objectives is revisited when the platform changes materially (new components, new data categories, or hosting/architecture changes).

Is there an SDLC process in place for newly developed software or systems that could interact with our data?

Yes. Branch-and-review model; automated CI gates (type-checking, linting, unit and end-to-end tests); automated architecture/security audits enforcing multi-tenant isolation and data-safety rules; human and AI-assisted security review; controlled database migrations with shadow-database isolation; per-environment secret management (never committed or logged); and automated dependency scanning with defined remediation SLAs. Deployments are zero-downtime with instant rollback.

Do you have a threat and vulnerability management program meeting industry standards?

Yes. A program aligned with industry-standard practices: automated dependency scanning, static analysis, periodic security assessment, remediation SLAs (critical 7 days, high 14 days), runtime anomaly monitoring, immutable audit logging, rate limiting, and secure-by-design controls. Not yet independently validated by an external penetration test or formal certification; both are on our roadmap.

Do you have a threat and vulnerability management policy?

Yes. See the attached Threat & Vulnerability Management Policy.

How often is the policy reviewed?

Annually (and on significant change).

What is the SLA for critical, high, medium vulnerability resolution?

Critical: within 7 days of confirmation. High: within 14 days. Medium: prioritized and scheduled into the normal release cycle.

What is the frequency of scanning?

Dependency (software-composition) scanning is continuous — on every code change and on a daily schedule, with advisories monitored daily. Static analysis runs on every change. Workplacer runs on fully managed, serverless infrastructure with no self-managed hosts or operating systems to scan at the host/network layer — that responsibility sits with our infrastructure providers. Independent external penetration testing is planned as the business scales.

Is endpoint protection used for hardware that can access, transmit, or store our data?

Yes. Company-controlled machines run built-in, always-on endpoint protection with full-disk encryption enabled, and customer data is hosted in the cloud rather than stored on endpoints.

Is production data used in test environments?

No. Test environments use dedicated seeded fixture data (a synthetic test tenant), not production customer data. Local development runs against a separate development database.

Do developers have access to production environments?

Yes. Given current team size, production access is limited to essential personnel on a least-privilege basis, through managed provider consoles protected by multi-factor authentication. Changes reach production only through a reviewed pipeline; secrets are per-environment; data-changing operations are recorded in an immutable audit log. Formal separation of duties will be introduced as the team grows.

Are all staff required to undergo security awareness, privacy, and/or HIPAA training?

No. As a founder-led team we do not currently operate a formal, recurring mandatory training program; responsibility sits with the founder. A formal program covering all employees and contractors will be introduced as the team grows. HIPAA is not applicable — we do not process HIPAA-regulated health data.

Is there a process for revoking access from terminated employees?

Yes. Access is granted per individual on a least-privilege basis and revoked immediately when a person leaves or a contract ends: application accounts and memberships are removed (invalidating active sessions), infrastructure access is removed through provider consoles, and shared secrets are rotated. Data-changing actions are recorded in an immutable audit log.

Subprocessors & transfers

What data storage and/or hosting providers are used to store, transmit, or process data?

Infrastructure (EU): Vercel (application hosting and file storage), Neon (database), AWS (underlying cloud), Upstash (cache). AI (US, under SCCs): Anthropic (analysis/summarization), Voyage AI (embeddings). Supporting services: Inngest (background jobs, US), Resend (email, EU/Ireland), Sentry (error monitoring, EU), Mapbox/Google/Geoapify (maps/geocoding). Authentication: Better Auth (self-hosted) with optional enterprise SSO (Microsoft Entra, Google, Apple). The authoritative subprocessor list is maintained in our DPA.

Has a DPA been signed with your subprocessors?

Yes. DPAs are in place with our primary subprocessors, incorporated into the service terms accepted on account setup, with EU Standard Contractual Clauses for transfers outside the EU.

What measures ensure subprocessors respect data processing requirements?

Contractual (DPA with each subprocessor, EU SCCs, sub-processor change notification), provider assurance (subprocessors maintain ISO 27001 / SOC 2 certifications), technical measures (EU data residency, encryption, data minimisation, PII scrubbing before AI processing, no model training on customer data, company-scoped access), and governance (maintained subprocessor list). Detail is in our published Data Processing Agreement.

In case of data transfer outside the EU, do you sign the most recent Standard Contractual Clauses with your subprocessors?

Yes. Transfers outside the EU (primarily to US-based AI and supporting providers) are governed by the European Commission's current (2021) Standard Contractual Clauses, incorporated into each subprocessor's DPA. Primary data at rest is EU-resident, so cross-border transfer is limited to specific functions, for which personal data is minimised and PII-scrubbed.

Incident response

Is there a security breach notification process if our data is breached?

Yes. Aligned with GDPR Article 33: on becoming aware of a breach affecting customer data we notify the affected customer without undue delay and no later than 72 hours, describing the nature, scope, likely consequences, and measures taken; immediate containment (rotate secrets/keys, invalidate sessions, review the audit log, remediate); and a follow-up root-cause report. Point of contact: jesper@workplacer.ai.

What notification delay do you observe in the event of a data breach?

Without undue delay, and no later than 72 hours after becoming aware, aligned with GDPR Article 33.

Data subject requests

Do you have an internal policy describing how data subject requests are handled?

Yes. See the attached Data Subject Request Handling Policy — self-service export and erasure, identity verification, response timelines, our processor-assist role toward customers, and anonymization of records retained for audit or legal integrity.

What is your notification delay when you receive a data subject request?

Self-service requests (export, erasure) are actioned immediately. Where we receive a request relating to a customer's data as processor, we notify the customer (controller) without undue delay so they can respond within the GDPR one-month deadline. Requests we handle directly as controller are answered without undue delay and within the one-month timeframe.

International transfers

Will any of our data be transferred into or outside of the EU? If so, to what countries?

Yes — to the United States, for a limited set of functions. The majority of data resides in the EU (Frankfurt, Germany): application, database, file storage, cache, and error monitoring. Certain functions transfer limited personal data to the US under EU Standard Contractual Clauses: AI analysis (Anthropic), embeddings (Voyage AI, with PII scrubbed), background job orchestration (Inngest), and maps/geocoding (Mapbox/Google, where used). No personal data is used to train external AI models.

Do you have a formal process you rely on for each transfer outside the EU?

Yes. A consistent process: EU-first residency; for any non-EU provider, a DPA incorporating the current (2021) EU Standard Contractual Clauses in place before data is transferred; data minimisation and automatic PII scrubbing; and selection of providers holding recognised certifications. Formal documented Transfer Impact Assessments per transfer are being introduced as our compliance program matures.

Does the process meet industry standards?

Yes. The process aligns with recognised industry standards for international transfers under GDPR Chapter V, relying on the European Commission's current Standard Contractual Clauses, data minimisation, PII scrubbing, and certified providers.

Documentation

Please provide the following documents for review.

Attached. Provided: Information Security Risk Management (Information Security Policy + Risk Management Policy), Access Control Policy, Business Continuity & Disaster Recovery Plan, Third-Party (Subprocessor) Management Policy, AI Governance Policy, Data Subject Request Handling Policy, Data Retention Schedule, a Security Documentation Index, and evidence of current cybersecurity insurance. Not held: SOC 2 / SOC 1 and ISO 27001 (and therefore no Statement of Applicability) — planned as the business scales. Not applicable: PCI (no cardholder data; billing handled externally) and HIPAA (no protected health information).

AI

Will AI be used in any of the services provided?

Yes. AI is used for document analysis/abstraction, insight and summary generation, semantic search, and an in-app assistant, via Anthropic (Claude) and Voyage AI (embeddings). Customer data is not used to train external models; personal data is scrubbed before AI processing; each customer controls how much document content the AI may access and can disable AI entirely; US transfers are governed by EU SCCs.

Do you have a formal policy governing the creation, maintenance, testing, operation, and termination of AI systems?

Yes. See the attached AI Governance Policy, covering model standards and development, an automated evaluation suite, operational data-handling controls (per-customer data-access modes, PII scrubbing, metering, rate limiting, tenant isolation, human oversight), maintenance, and termination (customer-controlled disablement; no customer data retained by providers for training).

How do you comply with the EU AI Act, and which risk category is the product in?

Assessed and documented against the AI Act's four risk levels. Workplacer is the provider of AI systems built on general-purpose models (Anthropic, Voyage AI); customers are deployers. *Prohibited (Art. 5):* no feature — no emotion recognition, biometric categorisation, social scoring or manipulation. *High risk (Art. 6, Annex III):* no feature — the platform analyses buildings, leases and workplace portfolios, and is not used for recruitment, employment decisions, task allocation based on personal traits, or monitoring or evaluating individuals. *Limited risk (Art. 50 transparency):* the in-app assistant, presented as an AI system, and text-generating features, whose output is labelled as AI-generated. *Minimal risk:* all other features, such as document extraction, classification and semantic search. Workplace survey data is processed only in aggregate, and groups below five respondents are never reported. The assessment is documented in section 3 of the AI Governance Policy.

How do you handle AI transparency and AI literacy?

Yes — both are covered. AI features and AI-generated output are identified as such in the product with one consistent mark, and the in-app assistant is labelled as an AI assistant with a notice to validate its answers. AI output is also marked in machine-readable form (Art. 50(2)): IPTC Digital Source Type metadata on AI content in the product, shared links, exported PDFs and presentations, emails and the API. Our AI providers, data handling and customer controls are documented in the AI Governance Policy, DPA and Trust page. Everyone at Workplacer who builds, operates or supports AI features completes internal AI literacy guidance (capabilities, limitations, reviewing outputs, data protection); completion is recorded and the guidance is refreshed at least annually.

Documentation

Our full security pack is published here — no request, no NDA, no waiting on us. Download whichever documents your review needs.

Security Documentation IndexCover note listing every document in this pack and the status of each control it describes.Download PDF Information Security Risk ManagementHow we identify, assess, treat, and monitor information security risk.Download PDF Access Control PolicyWho can reach systems and customer data, on what basis, and how that access is reviewed.Download PDF Business Continuity & Disaster Recovery PlanHow availability is maintained and how we recover from disruption, with stated objectives.Download PDF Threat & Vulnerability Management PolicyHow threats and vulnerabilities are identified, classified, remediated, and monitored.Download PDF Third-Party (Subprocessor) Management PolicyHow we select, contract, and oversee the providers that process customer data.Download PDF AI Governance PolicyHow the AI capabilities in the platform are developed, tested, operated, and retired.Download PDF Data Subject Request Handling PolicyHow GDPR data subject requests are received, verified, and fulfilled.Download PDF Data Retention ScheduleWhat we keep, for how long, and what happens to it on termination or erasure.Download PDF Privacy by DesignHow privacy is built into the architecture, mapped to the seven foundational principles.Download PDF Data FlowWhere customer data comes from, where it is stored and processed, and which providers see it.Download PDF

Contact

For security questions, anything not covered above, or to report a concern, contact jesper@workplacer.ai.