What is SOC 2 Compliance?
SOC 2 compliance, established by the American Institute of Certified Public Accountants (AICPA), involves a thorough audit that evaluates an organization's systems and controls for processing customer data. It focuses on security, availability, processing integrity, confidentiality, and privacy of the system. **SOC 2 Type 1 vs. Type 2:** * **Type 1** -- Assesses the design of security processes at a specific point in time. * **Type 2** -- Examines the operational effectiveness of these processes over a period, typically six months to a year. We360.ai has been awarded both SOC 2 Type 1 and Type 2 compliance.GDPR Readiness
We360.ai's data handling practices align with the General Data Protection Regulation (GDPR), ensuring lawful processing, data minimization, and support for data subject rights for individuals within the European Union.HIPAA Considerations
For organizations handling protected health information, We360.ai's encryption, access controls, and audit logging capabilities support HIPAA compliance requirements.Data Encryption
* **In Transit** -- All data transmitted between the agent and We360.ai servers is encrypted using TLS. * **At Rest** -- All stored data is encrypted using industry-standard encryption on Google Cloud Platform (GCP) infrastructure.Infrastructure and Hosting
We360.ai leverages the security protocols of Google Cloud Platform (GCP) for data infrastructure, providing robust protection and high availability.1. Introduction
This document outlines the operational, governance, security and support processes followed for We360.ai. The purpose of this document is to provide enterprise customers with transparency into the systems, processes and controls that ensure reliable and secure service delivery. This document is intended to address common requirements raised during: * Vendor Due Diligence * Security Questionnaires * Enterprise RFP processes * IT and Risk Assessments **The document covers:** * Product Release Management * Change Management * Incident Management * Infrastructure Governance * Data Security Practices * Business Continuity & Disaster Recovery * Customer Onboarding * Customer Support & Escalation * Vendor & Third-Party Governance * Compliance and Operational Governance * Continuous Improvement * Security Certifications, Compliance & Regulatory Alignment * Data Protection & Data Flow Architecture * Security Controls & Technical Safeguards * Risk Management & Security Governance Framework * Secure Software Development Lifecycle (SSDLC) * Service Level Agreements (SLA) & Operational Commitments · Data Residency, Data Ownership & Customer Rights · Audit, Reporting & Compliance Assurance2. Product Release Management
We360.ai follows a structured release management process to ensure that all product updates are delivered in a controlled, reliable and secure manner. Release Lifecycle 2.1 Product Planning Product features and enhancements are identified through: * Product roadmap planning * Customer feedback * Security improvements * Performance enhancements Features are prioritized based on customer impact and business value. 2.2 Development Engineering teams develop product features in controlled development environments. Secure development practices are followed, including: * Version control * Code reviews * Branch management * Development environment segregation 2.3 Code Review All code changes undergo peer review to ensure: * Code quality * Security best practices * Performance standards * Compliance with architecture guidelines 2.4 Testing Multiple testing layers are performed before release: * Functional testing * Regression testing * Performance testing * Integration testing Where applicable, security checks and vulnerability scans are also conducted. 2.5 Staging Validation Approved builds are deployed to staging environments that replicate production configurations. This allows teams to validate: * System stability * Integration compatibility * Feature behaviour 2.6 Production Release Once validation is complete, releases are deployed to production environments through controlled deployment pipelines. Deployment typically occurs during planned release windows to minimize service impact. 2.7 Post-Release Monitoring After deployment, system monitoring tools track: * Performance metrics * Error logs * System availability Any anomalies are investigated immediately. 2.8 Release Types | Release Type | Description | | ----------------- | --------------------------------------- | | Minor Release | Bug fixes and small improvements | | Feature Release | New features or enhancements | | Emergency Release | Critical fixes such as security patches | Release notes and change logs are maintained for traceability.3. Change Management
A structured change management process ensures that modifications to the system are implemented in a controlled and auditable manner. 3.1 Change Categories Standard Changes Routine operational updates with minimal risk. Examples: * Minor configuration updates * System optimizations Normal Changes Planned system updates requiring internal review and approval. Examples: * Feature updates * Infrastructure modifications Emergency Changes Urgent changes implemented to resolve critical issues such as system outages or security vulnerabilities. 3.2 Change Management Process 1\. Change Request Initiation o Internal change request logged 2\. Impact Assessment o Risk analysis conducted o Technical impact reviewed 3\. Approval o Relevant technical stakeholders approve the change 4\. Deployment Planning o Release window defined o Rollback plan prepared 5\. Implementation o Change deployed in production environment 6\. Validation o System performance verified o Functionality confirmed 7\. Documentation o Change logs updated o Records maintained for audit purposes4. Incident Management
We360.ai follows a structured incident management framework to ensure that service disruptions are addressed quickly and effectively. 4.1 Incident Sources Incidents may be identified through: * System monitoring alerts * Customer support reports * Internal engineering detection * Infrastructure monitoring tools 4.2 Incident Response Workflow 1\. Incident detection 2\. Incident logging 3\. Severity classification 4\. Investigation by engineering team 5\. Issue resolution or mitigation 6\. Root cause analysis 7\. Preventive actions 4.3 Incident Severity Levels | Severity | Description | | -------- | ---------------------------------- | | Critical | Complete system outage | | High | Major feature disruption | | Medium | Partial functionality issue | | Low | Minor issue or enhancement request | Critical incidents receive immediate attention from engineering teams. 5\. Infrastructure & Cloud Hosting We360.ai is hosted on secure cloud infrastructure designed for scalability, availability and reliability. 5.1 Infrastructure Characteristics * Cloud-native architecture * Scalable infrastructure resources * High availability configuration * Continuous system monitoring 5.2 Hosting Environment We360.ai is hosted on secure cloud infrastructure with primary hosting located in India to support enterprise data residency expectations. Infrastructure includes: * Secure networking layers * Firewall configurations * Access restrictions * Monitoring systems 5.3 Infrastructure Monitoring Infrastructure monitoring tools track: * Server health * System availability * Resource usage * Error logs Alerts are triggered if abnormal behaviour is detected.6. Data Security & Privacy
Data security is a core operational priority. 6.1 Security Controls Key security practices include: * Encryption of data in transit using secure protocols * Controlled access to infrastructure and administrative systems * Continuous monitoring of system activity * Logging and auditing mechanisms 6.2 Access Management Access to We360.ai is governed through: · Role-Based Access Control (RBAC): Users are assigned permissions based on their roles within the organization. · Least Privilege Model: Users and administrators receive only the minimum access required to perform their responsibilities. · Administrative Access: Administrative system access is restricted to authorized personnel and monitored through logging systems.7. Business Continuity & Disaster Recovery
Business continuity processes ensure that We360.ai can continue operating even during unexpected disruptions. 7.1 Key Measures * Automated data backup procedures * Infrastructure redundancy * Disaster recovery planning * Operational monitoring 7.2 Backup Policy System configurations and essential operational data are backed up regularly to ensure recoverability. 7.3 Disaster Recovery In the event of infrastructure disruption: 1\. Engineering teams investigate the failure 2\. Recovery procedures are initiated 3\. Services are restored using backup infrastructure Periodic reviews ensure disaster recovery readiness.8. Customer Onboarding
Customer onboarding is designed to allow new organizations to start using We360.ai quickly and efficiently. 8.1 Onboarding Steps Step 1: Account Creation Users register on We360.ai and verify their accounts. Step 2: Organization Setup Customers configure their organization profile and workspace. Step 3: Onboarding Wizard A guided onboarding wizard assists users with: * Initial configuration * Team member setup * System settings Step 4: User Management Administrators add team members and assign roles. Step 5: System Setup Customers configure productivity & team mapping role setting required for data collection. Step 6: Data Synchronization Once setup is complete, operational data begins appearing in We360.ai dashboard. Documentation such as the 5-Minute Launch Guide helps users quickly understand We360.ai functionality.9. Customer Support & Escalation
Customer support ensures that users receive assistance when needed. 9.1 Support Channels Customers can reach support through: * Email support * Support ticket system * Customer success engagement 9.2 Support Escalation Model | Level | Responsibility | | ------- | --------------------------- | | Level 1 | Customer Support Team | | Level 2 | Product Support Specialists | | Level 3 | Engineering Team | Critical issues are escalated immediately to engineering teams for investigation.10. Vendor & Third-Party Management
We360.ai may utilize third-party service providers to support infrastructure and operations. 10.1 Vendor Categories Typical vendors include: * Cloud infrastructure providers * External Auditors * Security tools 10.2 Vendor Evaluation Before engaging with any vendor, the following factors are reviewed: * Security posture * Infrastructure reliability * Compliance standards * Operational stability Vendor relationships are periodically reviewed to ensure ongoing compliance.11. Compliance & Security Governance
Governance processes ensure alignment with enterprise operational and security expectations. 11.1 Governance Controls The organization maintains documentation related to: * Product architecture * Security practices * Release history * Change logs * Operational procedures These documents support enterprise: * Vendor risk assessments * Security reviews * Compliance audits * RFP evaluations12. Continuous Improvement
We360.ai follows a continuous improvement approach to enhance reliability, security and customer experience. 12.1 Improvement Initiatives * Monitoring system performance * Reviewing incident trends * Implementing security improvements * Incorporating customer feedback * Enhancing operational processes Regular internal reviews ensure We360.ai evolves to meet enterprise operational standards.13. Security Certifications, Compliance & Regulatory Alignment
We360.ai follows industry-recognized security and privacy standards to ensure the protection of customer data and operational integrity. The organization aligns with globally accepted frameworks, regulatory requirements and security best practices. These certifications and compliance programs demonstrate our commitment to maintaining enterprise-grade security, privacy protection and regulatory adherence. 13.1 Security Certifications SOC 2 Type II We360.ai maintains compliance with SOC 2 Type II, which validates that the organization's internal controls meeting the Trust Service Criteria. SOC 2 Type II focuses on the following trust principles: * Security * Availability * Processing Integrity * Confidentiality * Privacy The certification involves an independent audit that evaluates the effectiveness of security controls over a defined monitoring period. This ensures that security practices are not only designed appropriately but also operate effectively over time. Key SOC 2 control areas include: * Access control management * Infrastructure monitoring * Change management * Incident response * Data protection controls * Vendor management ISO/IEC 27001 We360.ai aligns with the ISO/IEC 27001 framework, which defines best practices for establishing and maintaining an Information Security Management System (ISMS). ISO 27001 focuses on: * Risk management * Information security policies * Asset management * Access control * Cryptography * Incident management * Business continuity This framework ensures a systematic approach to managing sensitive information and maintaining strong security governance practices. ISO/IEC 27017 We360.ai aligns with ISO/IEC 27017, which provides additional security guidance specifically for cloud service providers and cloud-based systems. Key areas covered include: * Cloud infrastructure security * Shared responsibility model * Virtual machine security * Cloud service configuration controls * Administrative access governance This standard ensures that cloud deployments follow recognized best practices for protecting data and workloads in cloud environments. ISO/IEC 27018 We360.ai follows privacy protection guidelines defined in ISO/IEC 27018, which focuses on protecting personally identifiable information (PII) in public cloud environments. Key protections include: * Restrictions on data processing * Transparency in data handling * Customer data ownership protections * Secure deletion of data * Privacy-focused operational controls 13.2 Security Assessments Vulnerability Assessment & Penetration Testing (VAPT) We360.ai undergoes periodic Vulnerability Assessment and Penetration Testing conducted by qualified security professionals. The objective of VAPT is to identify potential security weaknesses and proactively address them before they can be exploited. The assessment typically includes: * Network vulnerability assessment * Application security testing * Infrastructure security review * Penetration testing simulations Findings from these assessments are prioritized based on severity and remediated according to internal security policies. Regular VAPT exercises help ensure We360.ai remains resilient against emerging security threats. 13.3 Privacy & Data Protection Regulations We360.ai is designed to support compliance with major global privacy regulations governing the protection of personal data. Digital Personal Data Protection Act 2023 (DPDP) We360.ai aligns with the requirements of the Digital Personal Data Protection Act 2023, which governs the processing of digital personal data in India. Key principles supported include: * Lawful data processing * User consent management * Data minimization * Secure storage and processing * Protection against unauthorized access These measures help ensure compliance with India's evolving data protection landscape. General Data Protection Regulation (GDPR) We360.ai supports compliance with the General Data Protection Regulation, which governs the protection of personal data for individuals within the European Union. GDPR compliance principles include: * Lawful processing of personal data * Transparency in data collection * Data minimization * Data subject rights * Security safeguards * Breach notification mechanisms We360.ai incorporates controls that enable organizations to meet GDPR requirements when handling personal data. California Consumer Privacy Act (CCPA) We360.ai supports compliance with the California Consumer Privacy Act, which provides California residents with enhanced rights regarding the use of their personal data. We360.ai enables organizations to support CCPA requirements including: * Data transparency * Consumer access rights * Data deletion requests * Data usage disclosures Health Insurance Portability and Accountability Act (HIPAA) For customers operating within healthcare ecosystems, We360.ai aligns with the principles of Health Insurance Portability and Accountability Act. HIPAA focuses on protecting Protected Health Information (PHI) through: * Administrative safeguards * Physical safeguards * Technical safeguards These protections help ensure the confidentiality, integrity and availability of sensitive healthcare data. 13.4 Ongoing Security Governance Security and compliance controls are continuously monitored and improved through: * Periodic security assessments * Internal security reviews * Infrastructure monitoring * Access control audits * Incident response testing * Security training and awareness The organization is committed to maintaining high standards of security and privacy to meet enterprise and regulatory expectations.14. Data Protection & Data Flow Architecture
We360.ai follows a secure data architecture designed to protect customer information throughout its lifecycle. The architecture incorporates security controls at every stage of data handling, including collection, transmission, processing, storage and deletion. The system architecture is designed following security frameworks such as SOC 2 Type II and ISO/IEC 27001. 14.1 Data Flow Overview We360.ai processes data through the following controlled stages: 1\. Data Collection 2\. Data Transmission 3\. Data Processing 4\. Data Storage 5\. Data Access & Usage 6\. Data Retention & Deletion Each stage incorporates encryption, authentication and monitoring mechanisms to protect data integrity and confidentiality. 14.2 Data Collection Data is collected from customer systems using secure integration methods configured during onboarding. Collection mechanisms may include: * Secure API integrations * Platform connectors or agents * System integrations configured by the customer * User inputs through the application interface Data collection follows the principle of data minimization, meaning only the data required for platform functionality is collected. Customer administrators retain control over integration configurations and permissions. 14.3 Data Transmission All communication between customer environments and We360.ai is secured using encrypted protocols. Transmission protections include: * HTTPS/TLS encrypted communication * Secure API authentication * Token-based authorization mechanisms * Network traffic monitoring Encryption prevents interception, tampering, or unauthorized access during data transmission. 14.4 Data Processing After transmission, data is processed within secured application environments. Processing operations may include: * Data analysis * Monitoring operations * Event correlation * System analytics Application services operate in isolated environments to ensure secure processing and prevent unauthorized cross-access. Strict access control policies ensure internal systems only access required datasets. 14.5 Data Storage Customer data is stored within secure cloud infrastructure environments. Security controls for storage include: * Encryption of stored data * Access-controlled databases * Network segmentation * Infrastructure monitoring Data is logically separated by tenant to ensure that one organization's data cannot be accessed by another. 14.6 Data Access Controls Access to platform data is governed through Role-Based Access Control (RBAC). User roles may include: * Organization Administrators * Operational Users * Read-Only Users Permissions are granted according to job responsibilities following the least privilege principle. Administrative system access is restricted to authorized personnel. .7 Data Retention Data retention policies define how long data is stored within We360.ai. Retention periods depend on: * Operational requirements and Agreements * Customer configuration * Security monitoring needs * Regulatory requirements Logs and operational data may be retained for monitoring, auditing and compliance purposes. 14.8 Data Deletion Data deletion procedures are implemented when: * Data reaches the end of its retention period * Customers request deletion * Customer contracts terminate Deletion processes may include: * Secure database deletion * Storage cleanup * Backup lifecycle expiration These processes help ensure that customer data is not retained beyond required periods. 14.9 Monitoring & Data Protection Controls Continuous monitoring is implemented to detect unauthorized activity or system anomalies. Monitoring mechanisms include: * Infrastructure monitoring * Application log monitoring * Security alerts * Access activity tracking Security events are handled through the incident management process. 14.10 Privacy Protection We360.ai supports compliance with major privacy regulations including: * Digital Personal Data Protection Act * General Data Protection Regulation * California Consumer Privacy Act * Health Insurance Portability and Accountability Act Privacy protections focus on secure data processing, transparency and protection of personal data.15. Security Controls & Technical Safeguards
We360.ai implements a layered security model designed to protect systems and customer data from unauthorized access, misuse and security threats. Security controls align with frameworks such as ISO/IEC 27001 and SOC 2 Type II. 15.1 Access Control Access to systems and data is governed by strict identity and access management policies. Controls include: * Role-Based Access Control (RBAC) * Least privilege access model * User authentication mechanisms * Administrative access restrictions Access rights are reviewed periodically to ensure that users retain only necessary permissions. Administrative access to production systems is limited to authorized personnel. 15.2 Authentication & Identity Management User identity verification is implemented through secure authentication mechanisms. These include: * Secure login authentication * Password policy enforcement * Session management controls * Access revocation procedures for inactive users Identity verification helps ensure that only authorized users access We360.ai. 15.3 Encryption Controls Encryption protects sensitive data during transmission and storage. Encryption measures include: Encryption in Transit * TLS-based encrypted communication * Secure API connections Encryption at Rest * Encrypted database storage * Secure storage configurations * Infrastructure-level encryption controls These encryption practices prevent unauthorized access to stored or transmitted data. 15.4 Logging & Audit Trails Logging systems capture activity across We360.ai to support monitoring, troubleshooting and security investigations. Logged events may include: * User authentication events * Administrative activities * System configuration changes * Access attempts * Security alerts Logs are retained for operational monitoring and compliance purposes. Audit trails help maintain accountability and transparency within We360.ai. 15.5 Security Monitoring Security monitoring systems continuously observe platform activity to identify potential threats. Monitoring capabilities include: * Infrastructure health monitoring * Application monitoring * Security alerting * Log analysis Alerts are generated for suspicious activities and investigated by engineering teams. 15.6 Vulnerability Management We360.ai maintains a proactive vulnerability management process. Security activities include: * Regular vulnerability scanning * Periodic Vulnerability Assessment and Penetration Testing * Security patching * Risk prioritization and remediation Security findings are reviewed and remediated based on severity levels. 5.7 Incident Response Security incidents are managed through a defined incident response process. The process includes: 1\. Detection of security events 2\. Incident classification 3\. Investigation and containment 4\. Resolution and recovery 5\. Root cause analysis Security incidents are handled in accordance with internal incident management procedures. 15.8 Security Governance & Continuous Improvement Security controls are continuously reviewed and improved through: * Security audits * Compliance assessments * Infrastructure monitoring * Incident trend analysis * Security awareness initiatives These measures ensure that We360.ai maintains a strong and evolving security posture.16. Risk Management & Security Governance Framework
The organization follows a structured risk management and security governance framework to ensure that information security risks are identified, assessed and mitigated in a systematic manner. The framework aligns with industry standards such as ISO/IEC 27001 and incorporates security best practices to protect systems, infrastructure and customer data. Security governance ensures that policies, procedures and controls are continuously reviewed and improved to maintain a strong security posture. 16.1 Information Security Governance Information security governance establishes the policies and responsibilities required to manage and protect organizational information assets. Key governance principles include: * Defined security policies and procedures * Role-based responsibilities for security management * Security oversight and accountability * Periodic review of security controls * Alignment with regulatory and compliance requirements Security governance helps ensure that security controls remain effective and aligned with business and regulatory expectations. 16.2 Risk Management Process A formal risk management process is followed to identify and mitigate risks associated with information systems and infrastructure. The risk management lifecycle includes the following stages: Risk Identification Potential risks are identified through: · Security assessments · Infrastructure reviews · Vulnerability scans · Incident analysis · Vendor assessments Risk Assessment Identified risks are evaluated based on: · Likelihood of occurrence · Potential impact on systems or data · Exposure to operational disruption Risk Mitigation Appropriate mitigation strategies are implemented, including: · Security controls · Process improvements · Infrastructure safeguards · Monitoring mechanisms Risk Monitoring Risks are continuously monitored to ensure controls remain effective. Periodic reviews are conducted to reassess risks and update mitigation strategies. 16.3 Security Policies & Standards The organization maintains documented security policies that guide operational and security practices. Key policy areas include: * Information security policy * Access control policy * Data protection policy * Incident response policy * Change management policy * Vendor management policy * Acceptable use policy These policies establish the security framework for managing and protecting organizational assets. 16.4 Security Risk Assessments Regular security assessments are conducted to identify vulnerabilities and evaluate the effectiveness of existing controls. Security assessments may include: * Internal security reviews * Infrastructure security assessments * Application security testing * Threat analysis Periodic Vulnerability Assessment and Penetration Testing is performed to detect potential vulnerabilities and strengthen We360.ai’s security posture. Findings are prioritized based on severity and remediated through defined security processes. 16.5 Security Awareness & Training Security awareness programs help ensure that employees understand their responsibilities in protecting organizational systems and data. Training initiatives may include: * Security awareness training * Data protection best practices * Secure system usage guidelines * Phishing and social engineering awareness These programs help reduce risks caused by human error and strengthen the overall security culture. 16.6 Vendor Risk Management Third-party vendors that support infrastructure or operational services are evaluated to ensure they meet security and reliability standards. Vendor risk assessments may include evaluation of: * Security posture * Compliance certifications * Infrastructure reliability * Data protection practices Vendor relationships are periodically reviewed to ensure continued compliance with security expectations. 16.7 Compliance Monitoring Security and compliance controls are regularly reviewed to ensure adherence to industry standards and regulatory requirements. We360.ai supports compliance with frameworks such as: * SOC 2 Type II * ISO/IEC 27001 * ISO/IEC 27017 * ISO/IEC 27018 Compliance activities include: * Security audits * Policy reviews * Control testing * Continuous monitoring 16.8 Continuous Security Improvement The organization follows a continuous improvement approach to maintain and enhance its security posture. Security improvements are driven by: * Incident reviews * Security audit findings * Vulnerability assessments * Emerging threat intelligence * Customer feedback and enterprise security reviews These practices ensure that the security program evolves to address new risks and maintain alignment with global security standards.17. Secure Software Development Lifecycle (SSDLC)
The organization follows a Secure Software Development Lifecycle (SSDLC) to ensure that security is integrated throughout the entire software development process. Security practices are incorporated from the initial design stage through development, testing, deployment and ongoing maintenance. The SSDLC framework ensures that security risks are identified early, vulnerabilities are minimized and secure coding practices are consistently followed. 17.1 Security by Design Security considerations are incorporated during the initial stages of product design and architecture planning. Key design practices include: * Threat modeling and risk identification during design stages * Secure architecture planning * Data protection and privacy considerations in system design * Implementation of least-privilege access principles * Secure API design and authentication mechanisms By addressing security at the design stage, potential vulnerabilities can be prevented before development begins. 17.2 Secure Development Practices Developers follow established secure coding guidelines to minimize vulnerabilities within application code. Secure development practices include: * Use of secure coding standards * Input validation and output encoding * Protection against common web vulnerabilities * Proper error handling and logging * Secure configuration management Development environments are controlled and separated from testing and production environments to prevent unauthorized access. 17.3 Code Review & Version Control All application code is maintained in version-controlled repositories and undergoes peer review before being merged into the main codebase. Code review processes help ensure: * Adherence to coding standards * Security best practices * Code quality and maintainability * Identification of potential vulnerabilities Version control systems maintain a history of changes, ensuring traceability and accountability for all modifications. 17.4 Security Testing Security testing is integrated into the development and testing lifecycle to identify vulnerabilities before software is released. Testing activities may include: * Application security testing * Static code analysis * Dynamic testing of application behavior * Dependency vulnerability checks In addition, periodic Vulnerability Assessment and Penetration Testing may be conducted to evaluate the security posture of We360.ai. Security issues discovered during testing are documented and remediated according to defined severity levels. 17.5 Environment Segregation To maintain system integrity and security, the organization maintains separate environments for: * Development * Testing * Staging * Production This separation ensures that development activities do not affect production systems and helps prevent unauthorized code from reaching live environments. Access to production environments is restricted to authorized personnel. 17.6 Secure Deployment Deployment processes follow controlled procedures to ensure that only approved and tested code is released into production environments. Deployment controls include: * Automated deployment pipelines where applicable * Controlled release management processes * Approval mechanisms for production releases * Rollback procedures in case of deployment issues Deployment logs are maintained to track system changes and maintain auditability. 17.7 Dependency & Vulnerability Management Software dependencies and third-party libraries are monitored to ensure they remain secure. Dependency management practices include: * Tracking third-party libraries and components * Monitoring known vulnerability databases * Applying security updates and patches when required Regular updates help reduce exposure to vulnerabilities present in external libraries. 17.8 Security Incident Handling If vulnerabilities or security issues are identified within the application, they are addressed through the organization’s incident management and vulnerability management processes. The process includes: 1\. Identification of the security issue 2\. Risk and severity assessment 3\. Remediation planning 4\. Deployment of security fixes 5\. Post-resolution review Security incidents are documented and analyzed to prevent recurrence. 17.9 Continuous Security Improvement The SSDLC framework is continuously improved through: * Security reviews of development practices * Feedback from security testing activities * Monitoring emerging threat landscapes * Improvements to development tools and processes These efforts ensure that the software development process evolves alongside evolving security threats and industry best practices.18. Service Level Agreements (SLA) & Operational Commitments
The organization is committed to maintaining reliable and consistent service delivery through clearly defined Service Level Agreements (SLAs) and operational processes. These commitments help ensure that enterprise customers receive dependable system availability, responsive support and timely resolution of operational issues. Operational commitments are designed in alignment with enterprise best practices and security frameworks such as SOC 2 Type II and ISO/IEC 27001. 18.1 Service Availability We360.ai is designed to provide high levels of service availability through resilient infrastructure and proactive monitoring. Key availability practices include: * Cloud-based infrastructure with scalable resources * Infrastructure monitoring and alerting systems * Redundant system components where applicable * Incident response procedures for service disruptions These measures help maintain continuous service availability and minimize downtime. 18.2 System Uptime Commitment We360.ai targets a high level of service availability for production environments. Typical uptime targets may include: | Service Component | Target Availability | | ------------------------- | ------------------------------- | | Application Platform | 99.9% uptime | | Core Services | 99.9% uptime | | Infrastructure Components | High availability configuration | Availability calculations typically exclude scheduled maintenance windows or extraordinary events beyond operational control. 18.3 Incident Response & Resolution Targets Incidents are prioritized based on severity and business impact. | Severity Level | Description | Response Target | Resolution Target | | -------------- | ----------------------------------------------- | ----------------------------- | ------------------------------- | | Critical | Complete service outage or major system failure | Immediate response | Highest priority resolution | | High | Major feature unavailable or major degradation | Within defined support window | Prompt resolution | | Medium | Partial functionality issue | Standard support response | Scheduled resolution | | Low | Minor issue or enhancement request | Best effort response | Future release or scheduled fix | Critical incidents receive immediate attention and escalation to engineering teams. 18.4 Support Availability Customer support services are available to assist customers with operational issues and platform usage questions. Support channels may include: * Email-based support * Customer success engagement * Technical support ticket system Support requests are tracked through internal ticketing systems to ensure accountability and timely resolution. 18.5 Escalation Process An escalation framework ensures that issues are addressed by the appropriate technical teams. | Escalation Level | Responsibility | | ---------------- | --------------------------------------- | | Level 1 | Customer Support Team | | Level 2 | Product Support / Technical Specialists | | Level 3 | Engineering Team | Critical or complex issues are escalated to engineering teams for investigation and resolution. 18.6 Scheduled Maintenance To maintain system reliability and performance, periodic maintenance activities may be performed. Maintenance activities may include: * Infrastructure updates * Security patching * Performance improvements * Platform upgrades Where possible, scheduled maintenance is conducted during predefined maintenance windows to minimize service disruption. Customers may be notified in advance of planned maintenance activities when they are expected to impact service availability. 18.7 Monitoring & Operational Oversight Continuous monitoring systems are implemented to detect and respond to operational issues. Monitoring capabilities include: * Infrastructure health monitoring * Application performance monitoring * System error tracking * Security alerting Alerts generated by monitoring systems are investigated promptly to maintain system stability. 18.8 Communication During Incidents When significant incidents occur, communication may be provided to affected customers through appropriate channels. Communication may include: * Notification of service disruption * Status updates during incident resolution * Confirmation when services are restored These communications help maintain transparency and provide customers with visibility into operational events. 18.9 Continuous Service Improvement Operational performance is regularly reviewed to identify opportunities for improvement. Service improvement initiatives may include: * Monitoring service performance metrics * Reviewing incident trends * Enhancing infrastructure reliability * Improving response and resolution procedures Continuous improvement ensures that operational processes evolve alongside customer needs and industry best practices.19. Data Residency, Data Ownership & Customer Rights
The organization is committed to ensuring transparency and accountability in how customer data is stored, processed and managed. This section outlines policies related to data residency, data ownership and customer rights concerning data hosted within We360.ai. These policies are designed to align with global data protection regulations and enterprise data governance expectations. 19.1 Data Residency Customer data is hosted in secure cloud infrastructure environments designed to meet enterprise security and compliance requirements. Where applicable, We360.ai supports hosting customer data within specific geographic regions to comply with regulatory or organizational data residency requirements. For customers operating in India, data may be hosted within infrastructure located in India to support compliance with the Digital Personal Data Protection Act and other applicable regulations. Data residency ensures that organizations maintain appropriate jurisdictional control over their data and comply with regional data protection laws. 19.2 Data Ownership Customers retain full ownership of the data they provide or generate within We360.ai. The organization does not claim ownership over customer data. Data collected and processed by We360.ai remains the property of the respective customer organization. Customer data is processed solely for the purpose of delivering platform services and supporting system functionality. The organization does not sell, rent, or commercially exploit customer data. 19.3 Data Usage Limitations Customer data is processed only for legitimate operational purposes related to the delivery of platform services. Permitted uses of data include: * Platform functionality and analytics * System monitoring and troubleshooting * Service improvement and reliability Data usage is governed by strict access control policies and internal security procedures. Unauthorized access, sharing, or use of customer data is strictly prohibited. 19.4 Customer Data Access Rights Customers maintain control over access to their data within We360.ai. Authorized customer administrators can: * Manage user access permissions * Configure system integrations * View and analyze operational data * Export data where functionality permits These controls allow organizations to manage data access in accordance with their internal governance policies. 19.5 Data Portability Customers may request access to their data in order to export or transfer it for operational or compliance purposes. Where technically feasible, data export capabilities may be provided through: * Application interfaces * System reports * Data export mechanisms Data portability supports customer flexibility and helps organizations maintain operational continuity. 19.6 Data Retention & Deletion Rights Customers may request deletion of their data in accordance with contractual agreements and operational requirements. Data deletion procedures may be initiated in the following circumstances: * Customer request * Contract termination * Expiration of defined retention periods Deletion processes ensure that customer data is securely removed from active systems and storage environments when no longer required. 19.7 Data Protection & Privacy Rights We360.ai supports organizations in meeting their obligations under global privacy regulations such as: * Digital Personal Data Protection Act * General Data Protection Regulation * California Consumer Privacy Act * Health Insurance Portability and Accountability Act Privacy protections include: * Secure handling of personal data * Controlled data access * Data protection safeguards * Transparent data processing practices These controls help ensure that organizations using We360.ai can meet their regulatory and privacy obligations. 19.8 Customer Transparency The organization is committed to transparency in data processing and privacy practices. Customers may request information regarding: * Data handling practices * Security controls * Compliance certifications * Operational policies This transparency supports enterprise due diligence and helps customers evaluate We360.ai’s security and compliance posture.20. Audit, Reporting & Compliance Assurance
The organization maintains structured processes to ensure transparency, accountability and compliance with recognized security and privacy standards. These processes support internal governance, external audits and enterprise vendor due-diligence requirements. Regular assessments, documentation and reporting mechanisms are maintained to ensure that operational, security and compliance controls are functioning effectively. 20.1 Internal Audits Periodic internal audits are conducted to evaluate the effectiveness of security and operational controls across We360.ai. Internal audits may review areas including: * Access control management * Infrastructure security * Application security practices * Incident management procedures * Change management controls * Data protection policies Findings from internal audits are reviewed by relevant stakeholders and corrective actions are implemented where necessary. 20.2 External Audits & Independent Assessments The organization may undergo independent third-party audits and security assessments to validate its compliance with industry standards. External assessments may include: * Security compliance audits * Infrastructure security reviews * Application security assessments * Penetration testing exercises Periodic Vulnerability Assessment and Penetration Testing helps identify potential vulnerabilities and ensures that We360.ai remains resilient against evolving threats. 20.3 Compliance Certifications We360.ai aligns with globally recognized security and privacy standards. Key certifications and frameworks include: * SOC 2 Type II * ISO/IEC 27001 * ISO/IEC 27017 * ISO/IEC 27018 These frameworks ensure that the organization maintains strong security governance, operational controls and privacy safeguards. 20.4 Regulatory Compliance Alignment We360.ai is designed to support compliance with major global privacy and data protection regulations, including: * Digital Personal Data Protection Act * General Data Protection Regulation * California Consumer Privacy Act * Health Insurance Portability and Accountability Act Operational policies and security controls help ensure that customer data is processed responsibly and in accordance with regulatory expectations. 0.5 Compliance Monitoring Compliance monitoring mechanisms help ensure that controls remain effective and aligned with security standards. Monitoring activities include: * Periodic security reviews * Policy compliance checks * Infrastructure monitoring * Security incident tracking * Change management reviews These processes ensure that security and compliance controls remain operational and up to date. 20.6 Audit Logging & Evidence Management We360.ai maintains logs and documentation that support audit requirements and operational transparency. Audit evidence may include: * Access logs * System activity logs * Change management records * Incident management reports * Security assessment reports These records support both internal governance and external compliance verification. 20.7 Customer Assurance & Transparency Enterprise customers may require assurance regarding We360.ai’s security posture and compliance status. Where applicable, customers may request information related to: * Security policies and procedures * Compliance certifications * Security assessment reports * Operational documentation This transparency helps organizations conduct vendor risk assessments and verify security practices. 20.8 Continuous Compliance Improvement Security and compliance programs are continuously improved through: * Feedback from internal and external audits * Security assessments and vulnerability testing * Updates to regulatory requirements * Improvements to operational controls Continuous improvement ensures that We360.ai maintains a strong compliance posture as regulatory expectations and security threats evolve.| :calendar: | Work & Time Management | Attendance, Leave Management, Invoicing, Notes, Projects & Tasks, Timesheets. | Work & Time Management |
| :chart-area: | Workforce Productivity | App & URL Tracking, Field Tracking, Insights, IT Tracking, Productivity Rules, Screen Tracking, GeoFencing. | Workforce Productivity |
| :chart-mixed: | Advanced Analytics | Business Intelligence, Capacity Planning, Technology Usage, Workforce Risk Intelligence. (Premium) | Advanced Analytics |
| :user-check: | Attendance | Employee attendance tracking and management. | Attendance |
| :umbrella-beach: | Leave Management | Employee leave request and approval system. | Leave Management |
| :file-invoice-dollar: | Invoicing | Invoice generation and management. | Invoicing |
| :sticky-note: | Notes | Note-taking and documentation features. | Notebook |
| :tasks: | Projects & Tasks | Project and task management capabilities. | Projects & Tasks |
| :table: | Timesheets | Timesheet tracking and reporting. | Timesheets |
| :clock-rotate-left: | Manual Time | Log untracked work with manager approval. | Manual Time |
> **Location:** HR Suite → Attendance
The **Leave Management** feature in We360.ai allows organizations to manage employee leave requests in a structured and transparent way. Employees can apply for leave, while managers and administrators can review, approve, reject, or edit leave requests based on their role and hierarchy. This ensures that leave requests are tracked properly and approvals follow the organization’s reporting structure. > **Feature Path: HR Suite → Leaves** *** ## User Roles and Permissions Leave management functionality varies depending on the user’s role within the organization. ### Employee (Standard User) Employees can manage only their own leave requests. Employees can: * Apply for leave * View their own leave applications * Track the status of their leave requests Employees **cannot view or take actions on other employees' leave requests**. ### Manager Managers can manage leave requests for employees within their team hierarchy. Managers can: * Apply for leave * View leave requests submitted within their reporting hierarchy * View their own leave requests * Approve leave requests * Reject leave requests * Edit leave requests within their hierarchy Managers **cannot take action on their own leave requests**. Once a manager **approves or rejects a leave request**, the decision becomes final and cannot be changed. ### Admin Admins have the highest level of control within the Leave Management module. Admins can: * Apply for leave * View leave requests across the organization * View their own leave requests * Approve leave requests * Reject leave requests * Edit leave requests Admins can take action on leave requests submitted by: * Admins * Managers * Standard users Just like managers, once an **Admin approves or rejects a leave request, the decision cannot be changed.** *** ## Role Hierarchy Leave approvals follow the organization’s reporting hierarchy. **Admin** * Can take action on leave requests from **Admins, Managers, and Standard Users** **Manager** * Can take action on leave requests from **members of their assigned team** **Standard User** * Can only view their own leave applications This hierarchy ensures that leave approvals follow proper organizational reporting structures. *** ## Applying for Leave Users can apply for leave directly from the **Leave module**. Users who can apply for leave include: * Employees * Managers * Admins In some cases, **Admins can also apply leave on behalf of users** if required. *** ## Leave Application Fields When submitting a leave request, users must provide the following details: #### Leave Type Select the type of leave from the available options in the dropdown. Examples may include: * Casual Leave * Sick Leave * Annual Leave * Other leave types defined by the organization. #### From Date Select the **start date** of the leave using the calendar picker. #### To Date Select the **end date** of the leave using the calendar picker. #### Reason Provide a brief explanation for the leave request. * Text input field * Maximum limit: **100 words** Providing a clear reason helps managers review and process leave requests more effectively. *** ## Overlapping Leave Restriction Users **cannot apply for overlapping leave requests**. If a user has already applied for leave covering a particular date, they cannot submit another leave request that includes the same date. Example: Existing leave request\ **10 June – 12 June** User **cannot submit another leave request that includes:** * 11 June * 12 June * 10–13 June This rule ensures that duplicate or conflicting leave requests do not occur. *** ## Leave Module Tabs The Leave module contains different tabs depending on the user’s role. ## Manager and Admin Tabs Managers and Admins have access to three tabs that help them manage leave requests. ### Pending Approvals This tab shows **leave requests waiting for approval** within the user’s hierarchy. Managers and Admins can review these requests and take appropriate action. Possible actions include: * Approve * Reject * Edit ### My Pending Leaves This tab shows **leave requests submitted by the logged-in user** that are still awaiting approval. Users can track the status of their submitted requests here. ### All Leaves The **All Leaves** tab displays all leave requests within the organization, regardless of their status. This provides a complete view of leave activity. #### Available Filters Users can filter leave data using: * **User Search** * **Leave Type** * **Request Status** * **Date Range** These filters help managers and admins quickly find specific leave requests. *** ## Employee Tabs Standard users (employees) see a simplified version of the leave module. ### Pending Approvals This tab shows leave requests submitted by the employee that are **still awaiting approval**. Employees can track their pending requests here. ### All Leaves This tab shows all leave requests submitted by the employee, regardless of status. Employees can view whether their requests are: * Pending * Approved * Rejected #### Available Filters Employees can filter their leave records using: * Leave Type * Request Status * Date Range *** ## Best Practices for Leave Management To ensure smooth leave management across the organization: **Submit leave requests in advance**\ This allows managers enough time to review and plan team availability. **Provide clear reasons for leave**\ This helps approvers make informed decisions. **Avoid duplicate requests**\ Make sure your leave dates do not overlap with existing requests. **Check leave status regularly**\ Employees can track approval progress from the leave dashboard. # Invoicing We360.ai billing and invoicing — manage subscriptions, view payment history, and configure invoice delivery. The **Billing & Invoices** tab shows your active subscription details and your full invoice history in one place. {% hint style="info" %} Only Tenant Owners can access **Organization & Billing**. {% endhint %} ## Open the billing page 1. Go to **Settings**. 2. Open **Organization & Billing**. 3. Select the **Billing & Invoices** tab. ## What you can see here ### Current subscription At the top of the page, you can review your current plan details, including: * **Plan name** * **Subscription status** * **Total usage** * **Next billing date** If plan upgrades are available for your workspace, you can also use the **Upgrade Plan** action from this page. ### Invoice history The **Invoices** section lists all generated invoices with: * **Invoice date** * **Due date** * **Total amount** * **Status** This helps you track whether an invoice is active, paid, due, or void. ## Email an invoice Each invoice row includes an option to send the invoice by email. Invoices are sent to the **contact person email** set in **Company Details**. {% hint style="warning" %} The contact email must belong to an active user in your We360.ai company. {% endhint %} ## Change the invoice email To change where invoices are sent: 1. Go to **Settings**. 2. Open **Organization & Billing**. 3. Select the **Company Details** tab. 4. Update the **contact person email**. 5. Save your changes. After that, future invoice emails will be sent to the updated contact email. # Notebook We360.ai notebook — private note-taking and documentation built into the employee productivity platform. The **Notebook** page is a private note space inside We360.ai. Each note is personal. Only the user who created the note can view and manage it. ## Create a note 1. Open the **Notebook** page. 2. Click **Take a Note**. 3. Enter your note using the available fields. 4. Save or submit the note from the note editor. ## What you can do here * Create personal notes for reminders, quick thoughts, or work references. * View your notes in a card-based layout. * Open and manage only the notes you created. * Delete a note when it is no longer needed. {% hint style="info" %} Notes are private by default. Other users cannot access notes created in your Notebook. {% endhint %} The Notebook feature in we360.ai is a lightweight documentation space designed to help users capture ideas, notes, and task-related information while working. It allows users to quickly jot down thoughts, meeting notes, reminders, or any work-related details without leaving the platform. Notebook is available within the Project Suite and can be accessed by Admins, Managers, and Standard Users. Each user maintains a personal notebook, ensuring privacy and focus. Notes created in the notebook are visible only to the user who created them. *** ## Accessing the Notebook To access the Notebook: 1. Navigate to the Project Suite from the main application switcher. 2. Select Notebook from the left navigation menu. Once opened, the Notebook workspace displays: * A quick input area to create a new note * Previously saved notes displayed as cards * Options to view, edit, or delete notes The interface is designed for quick access so users can capture information instantly during their workflow. *** ## Creating a Note Adding a note in the Notebook is simple and quick. To create a new note: 1. Click on “Take a Note…” at the top of the Notebook page. 2. A note editor will open. 3. Enter a Title for your note. 4. Write your content in the note editor. 5. Click Save to store the note. Once saved, the note will appear in the notebook as a card for easy access. *** ## Editing a Note Users can modify their notes anytime. To edit a note: 1. Click on the note card you want to modify. 2. The note will open in the editor view. 3. Make the required changes. 4. Click Save to update the note. This allows users to continuously refine their notes as tasks evolve. *** ## Deleting a Note If a note is no longer required, it can be removed. To delete a note: 1. Locate the note card in the notebook. 2. Click the Delete icon on the note card. The note will be permanently removed from your notebook. *** ## Note Formatting Options The Notebook editor supports rich text formatting to help structure your notes clearly. You can format your notes using the following options: #### Headings * Heading 1 * Heading 2 * Heading 3 * Normal text These help organize notes into readable sections. *** #### Text Formatting You can format text using: * Bold * Italic * Underline * Remove formatting These options allow you to emphasize important information. *** #### Lists Create structured lists using: * Numbered lists * Bullet lists This is useful for action items, task lists, or meeting summaries. *** #### Links You can insert clickable links within your notes to reference external resources or documentation. *** ## Copy-Paste Formatting Support Notebook supports preserving formatting when pasting content from other sources. If you copy text from documents, emails, or web pages and paste it into the notebook, the existing formatting (such as headings, bold text, or lists) will remain intact wherever supported. This makes it easier to transfer structured content into the notebook without having to reformat it. *** ## Data Retention Notes created in the Notebook are not automatically deleted. They remain saved in the user's account and can be accessed anytime in the future. This makes the Notebook useful for long-term documentation, reference material, and work records. *** ## Privacy of Notes Notebook is designed as a personal workspace. * Each logged-in user can only see their own notes. * Notes are not visible to other users in the organization. This ensures users can freely record ideas, drafts, and personal task notes without affecting team data. *** ## Limitations While the Notebook supports rich text editing, certain content types are currently not supported. The following cannot be added to notes: * Images * Videos * PDF files * File attachments Notebook is intended for text-based documentation and quick note-taking. *** ## Common Use Cases Users typically use the Notebook to: * Capture quick ideas during work * Maintain meeting notes * Track daily work summaries * Store reference links * Write task reminders * Draft documentation Because it is built directly into the platform, users can document information without switching between tools.
The **Notebook** feature in We360.ai is a lightweight documentation space designed to help users capture ideas, notes, and task-related information while working. It allows users to quickly jot down thoughts, meeting notes, reminders, or any work-related details without leaving the platform. Notebook is available within the **Project Suite** and can be accessed by **Admins, Managers, and Standard Users**. Each user maintains a **personal notebook**, ensuring privacy and focus. Notes created in the notebook are visible only to the user who created them.
Project Management
The **Project** serves as a high-level overview of all projects within the workspace. It provides: * A consolidated list of all projects * Visibility into project ownership and structure * Financial indicators such as billing type (non-billable, time-based, fixed, mixed, or inherited from the organization default) * Quick insight into project distribution and status Each project is identified with a unique key, name, and ownership, and exists in a defined lifecycle: * **Active** → Work is ongoing * **Archived** → Work is paused; the project is hidden from operational views but can be reactivated * **To Be Deleted** → The project is queued for permanent removal Projects remain active until explicitly archived or marked for deletion, ensuring continuity and visibility. Projects can be **Public** (visible to everyone in the organization) or **Private** (accessible only to assigned members). This lets teams keep sensitive work restricted while keeping general work transparent and searchable. This enables teams to monitor multiple projects simultaneously without diving into individual task details.Task Management
Tasks are the core execution units within a project. Each task captures all essential information required to complete work, including: * Task summary and description * Task type (Epic, Task, or Bug) * Assignee, Reporter, Reviewer or QA * Status, priority, and tags * Start date and due date * Time estimate and story points Tasks move through a defined lifecycle. Each project defines its own set of statuses through workflow settings; a new project is seeded with defaults such as: * **To Do** * **In Progress** * **Done** Teams can add or rename statuses (for example, a **Review** or **Blocked** stage) to match how they work. This provides a consistent way to track progress and understand the current state of work. *** **Task Views** Tasks can be visualized in multiple formats to suit different workflows:| List View → | Structured, data-heavy view for detailed tracking |
| Kanban View → | Status-based visualization for workflow tracking |
| Structured Task Creation → | For detailed tasks with full context |
| Inline Task Creation → | For quickly adding tasks during planning |
Child Tasks (Granular Execution)
Child Tasks allow teams to break down complex tasks into smaller, actionable components. This enables: * Better distribution of work * Clearer ownership * More accurate tracking of progress Child tasks remain linked to their parent task, ensuring that detailed execution stays connected to the broader objective.| :window-restore: | App & URL Tracking | Application and URL monitoring capabilities. | App & URL Tracking |
| :map-marked-alt: | Field Tracking | Field employee location and activity tracking. | Field Tracking |
| :lightbulb: | Insights | Analytics and insights dashboard. | Insights |
| :laptop: | IT Tracking | IT asset and system monitoring. | IT Tracking |
| :ruler: | Productivity Rules | Configuring productivity measurement rules. | Productivity Rules |
| :camera: | Screen Tracking | Screenshot and screen monitoring features. | Screen Tracking |
| :map-pin: | GeoFencing and Controls | Location-based monitoring and access controls. | GeoFencing and Controls |
| :usb: | USB Detection | Monitor USB and external device connections. | USB Detection |
| :gauge-high: | Employee Scoring & Scorecards | A configurable monthly performance score and scorecard. | Employee Scoring & Scorecards |
Strategic-Level Insights
**Organisation-Wide Productivity Intelligence** * *Features used: AI productivity analytics, executive dashboards* * **Insights:** Productivity comparisons across departments, roles, locations. Identification of high/low-performing teams. Capacity planning inputs. * **Business Impact:** Better org design, performance-linked budgeting, data-backed leadership decisions. **Workforce Risk Prediction** * *Features used: Wellness & Activity* * **Insights:** Early signals of disengagement, overwork, teams at attrition risk, overtime-driven productivity decline. * **Business Impact:** Reduced hiring cost, retention strategy planning, proactive HR interventions. **Digital Transformation Maturity** * *Features used: App usage, URLs, workflow analytics* * **Insights:** Which tools are highly used, underutilised, redundant. ROI on SaaS stack. * **Business Impact:** SaaS cost rationalisation, tool consolidation, automation roadmap.HR & People Analytics Insights
**Employee Performance Intelligence** * *Features used: Productivity mapping, activity tracking, focus time* * **Insights:** Productive vs unproductive time, deep work vs shallow work patterns, individual work styles. * **Use Cases:** Performance reviews based on data, personalised coaching, role–person fitment. **Workload & Capacity Balancing** * *Features used: Wellness360, active/idle time* * **Insights:** Who is overutilised, underutilised, or optimally loaded. Real capacity of teams. * **Business Impact:** Better resource allocation, reduced burnout, improved delivery timelines. **Attendance Behaviour Intelligence** * *Features used: Automated attendance, break trends, shift tracking* * **Insights:** Late-coming patterns, shift efficiency, break behaviour analytics. * **Business Impact:** Policy optimisation, hybrid work model design, payroll accuracy.Operations & Delivery Insights
**Process Efficiency Mapping** * **Insights:** Actual time taken vs planned time, repetitive manual work. * **Business Impact:** SOP redesign, automation opportunities, faster turnaround time. **Project Execution Intelligence** * **Insights:** Realistic project timelines, effort estimation accuracy, delivery risk alerts. * **Business Impact:** Better client commitments, improved project margins. **Real-Time Vigilance for Leaders** * **Insights:** Instant operational visibility, work status without review meetings, real-time performance dips. * **Business Impact:** Faster decision cycles, reduced manual reporting.Finance, Compliance & Security
**Finance & Cost Optimisation** * *Cost of Productivity:* Cost per productive hour, payroll vs actual output, team-wise efficiency ROI. * *SaaS & Tool ROI:* Paid tools not being used, shadow IT detection, license optimisation. * *Manpower Planning:* Whether to hire or optimise existing capacity, outsource vs in-house decisions. **Compliance & Security** * **Insights:** Data misuse risk, policy adherence, device usage compliance. * **Business Impact:** Stronger audit readiness, reduced insider risk.Employee Experience & Culture
**Work-Life Balance Index** * **Insights:** After-hours work patterns, burnout hotspots, healthy vs overloaded teams. **Additional Insights** * **Engagement Signals:** Culture health measurement and manager effectiveness evaluation derived from focus time and activity patterns. * **Managerial Effectiveness:** Measure which managers overload teams or deliver high productivity to become a manager scorecard system. * **Remote & Hybrid Work:** Remote vs office productivity, ideal work models for each function, location-wise performance.| :chart-line: | Business Intelligence | Cross-team analytics and trends for leadership decisions. | Business Intelligence |
| :people-group: | Capacity Planning | Balance workload and utilization across the workforce. | Capacity Planning |
| :microchip: | Technology Usage | Understand how software and tools are used across the org. | Technology Usage |
| :triangle-exclamation: | Workforce Risk Intelligence | Surface people and teams that need attention early. | Workforce Risk Intelligence |
| :desktop: | Desktop App | Desktop application features and usage. | Desktop App |
| :mobile-alt: | Mobile App | Mobile application features and usage. | Mobile App |
| :globe: | Portal | Web portal features and usage. | Portal |
| :browser: | Chrome Extension | Chrome Extension features and usage | Chrome Extension |