Last Updated: 20 October 2026

Data Security, Privacy & Compliance Overview

Workex is built for organisations that handle sensitive workforce and compliance data. Security is built into every layer of the platform: who can sign in, how data is stored, and what happens when you leave.

This page explains how we protect your data. It is written for customers, procurement teams and anyone running a security or vendor risk review.

At a glance

Your data is yours. We claim no ownership of it and only use it to deliver our services.
Encrypted everywhere. TLS 1.2 or higher in transit, AES-256 at rest.
Strict access control. Role-based permissions on the principle of least privilege, checked on the server for every request.
Isolated by design. Each customer's data is logically separated from every other customer's.
Fully logged. Sign-ins, data access, configuration changes and admin actions are recorded.
Clean exit. Export your data at any time. After termination, it is deleted from active systems and backups within 30 days.
Aligned with recognised standards. SOC 2, ISO/IEC 27001 and GDPR.

Our platform

Workex runs on Convex (https://www.convex.dev/), a modern, secure and scalable backend platform. Convex lets us deliver real-time features while enforcing strict access controls, keeping data consistent and staying highly available.

Our controls cover technical, organisational and procedural safeguards. They are designed to reduce risk, protect customer data and support your governance and audit requirements.

Security & access control

Authentication and authorisation

Only verified users and authorised systems can reach platform resources.
Identity is verified with secure authentication protocols and token-based session management.
Every request is validated before it runs, so users can only reach the data and features their permissions allow.
Sensitive operations run only through validated server-side functions. The database is never exposed directly.

Role-based access control (RBAC)

Permissions are assigned by role, such as owner, administrator, customer and employee.
Access follows the principle of least privilege and is managed centrally. That covers onboarding, role changes and removing access.
Role checks are built into every data query and change, which protects against privilege escalation and cross-tenant access.

Encryption

Standard

Data in transit

TLS 1.2 or higher (HTTPS) for all client, API and service traffic

Data at rest

AES-256 for databases and file storage

Higher-sensitivity data

Optional application-layer (field-level) encryption, so data is encrypted before storage and only decrypted for authorised use

Customer-specific requirements, such as key ownership, key rotation or field-level encryption scope, can be documented in your agreement.

API security and rate limiting

All APIs are reachable only over encrypted HTTPS (TLS 1.2+).
Requests are authenticated with tokens and role-based access controls.
Rate limiting and input validation on every endpoint protect against denial-of-service, brute-force attacks and excessive use.
API activity is logged and monitored to spot anomalies and support incident response.

Audit logging and monitoring

Critical activity is logged securely. That includes sign-ins, data access, configuration changes and administrative actions.
Logs are protected against tampering and kept in line with our security and compliance policies.
Only authorised personnel can access logs, on a least-privilege basis.
Central monitoring and alerting help us find and fix potential threats quickly.

Data protection & privacy

Data isolation

Workex uses a logical multi-tenant architecture. Each customer's data is partitioned securely, and only authenticated, authorised requests can reach it. Queries only ever return data belonging to the authorised tenant. RBAC, encryption, secure sessions and audit logging back this up.

Backup and disaster recovery

Backups run automatically and are stored in redundant environments.
Data is replicated with geographic redundancy and automated failover.
Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) are documented and checked through periodic testing.
Access to backups is restricted by role, strong authentication and audit logging.

Data retention and deletion

We keep data only as long as we need it to deliver the service and meet legal obligations.

Retention schedules are set by legal, regulatory and contractual requirements.
Archiving and deletion are automated.
Customer data is permanently deleted on contract termination or an authorised request, unless the law requires us to keep it.
Deleted data is removed from active systems and purged from backups on a fixed schedule.
Access, changes and deletions are all recorded in audit logs.
These policies are reviewed regularly as regulations change.

Privacy and regulatory compliance

Workex processes personal information lawfully, fairly and transparently. Privacy by design and privacy by default are built into our systems and processes. The platform supports data subject rights and aligns with applicable privacy law, including the General Data Protection Regulation (GDPR).

Incident response

We run a structured incident response programme to detect, contain and fix security and privacy incidents quickly. It includes:

Defined escalation procedures
Forensic investigation and root cause analysis
Corrective action and follow-up
Notifying affected customers in line with our contracts and regulatory requirements
Documenting every incident to support audits and continuous improvement

Infrastructure & reliability

Redundancy and failover

Data is replicated automatically across resilient infrastructure. If a system fault or regional outage happens, automated failover moves operations to healthy resources without manual steps. Continuous monitoring and integrity checks back this up.

Uptime and SLAs

Workex is built for high availability and automatic scaling. Uptime commitments, support response times and scheduled maintenance are set out in each customer's Service Level Agreement (SLA).

Data residency

Data is stored and processed in approved geographic regions, in line with residency and sovereignty requirements. Where needed, we support region-specific data handling and lawful international transfers, including through Standard Contractual Clauses (SCCs). Hosting locations are available on request or set out in your agreement.

Network security and DDoS protection

Zero-trust model: strict authentication, authorisation and least privilege at every layer
Public endpoints limited to essential services, with backend operations isolated
Enterprise-grade DDoS protection, including traffic filtering, rate limiting, anomaly detection and automated mitigation
Continuous monitoring and real-time threat detection

Penetration testing and security audits

Testing follows the OWASP Top 10 and NIST guidelines.
It covers application logic, API endpoints and data access layers.
It combines internal reviews, automated vulnerability scanning and periodic external penetration tests, including independent third-party experts where applicable.
Findings are prioritised, fixed through a formal process and retested.
Executive summaries and remediation attestations are available to customers under NDA.

Intellectual property safeguards

You own your data

All customer data and intellectual property in Workex stays the exclusive property of the customer. Workex claims no ownership, licence or derivative rights over it. We access it only to deliver contracted services, keep the platform running and provide support. You can access, export, change and delete your data at any time.

Third-party access

We never disclose customer data to third parties without your explicit authorisation or a lawful basis.
Access is limited to essential service providers, and only when it's needed to deliver the service.
All subprocessors go through a vendor risk assessment and are bound by Data Processing Agreements (DPAs) and confidentiality obligations.
Subprocessors are reassessed periodically.

Confidentiality and NDAs

Every employee, contractor and authorised representative signs a legally binding Non-Disclosure Agreement as a condition of working with us. Vendors and subprocessors are bound by NDAs and DPAs as well.

Account termination and data exit

Export: you can export your data securely before your account closes.
Controlled access: during the exit process, all access needs authenticated requests and role-based permissions.
Deletion: once termination is confirmed, your data is permanently removed from active systems and backups within 30 days.
Verification: exports and deletions are recorded in audit logs.

The only exception is data we must keep to meet contractual, legal or regulatory obligations.

Compliance & industry standards

Workex aligns its security and compliance programme with recognised international frameworks:

Framework

What it covers

SOC 2 Trust Services Criteria

Security, availability, processing integrity, confidentiality and privacy controls

ISO/IEC 27001

A structured Information Security Management System (ISMS) for identifying and managing risk

GDPR

Lawful, fair and transparent processing of personal data, and data subject rights

NIST & OWASP

Risk management and application security testing

Vulnerability and risk management

We run continuous monitoring, regular vulnerability scans and periodic risk assessments. Vulnerabilities are prioritised with the Common Vulnerability Scoring System (CVSS), tracked through a formal remediation process and documented for audits.

Continuous improvements

A formal security roadmap, guided by risk assessments, regulatory changes, customer needs and threat intelligence, keeps our controls current. Every improvement is documented and tracked.