Company Processes
We360.ai governance — security processes, workforce analytics policies, and organizational compliance documentation.
1. Introduction
This document outlines the operational, governance, security and support processes followed for We360.ai. The purpose of this document is to provide enterprise customers with transparency into the systems, processes and controls that ensure reliable and secure service delivery.
This document is intended to address common requirements raised during:
Vendor Due Diligence
Security Questionnaires
Enterprise RFP processes
IT and Risk Assessments
The document covers:
Product Release Management
Change Management
Incident Management
Infrastructure Governance
Data Security Practices
Business Continuity & Disaster Recovery
Customer Onboarding
Customer Support & Escalation
Vendor & Third-Party Governance
Compliance and Operational Governance
Continuous Improvement
Security Certifications, Compliance & Regulatory Alignment
Data Protection & Data Flow Architecture
Security Controls & Technical Safeguards
Risk Management & Security Governance Framework
Secure Software Development Lifecycle (SSDLC)
Service Level Agreements (SLA) & Operational Commitments
· Data Residency, Data Ownership & Customer Rights
· Audit, Reporting & Compliance Assurance
2. Product Release Management
We360.ai follows a structured release management process to ensure that all product updates are delivered in a controlled, reliable and secure manner.
Release Lifecycle
2.1 Product Planning
Product features and enhancements are identified through:
Product roadmap planning
Customer feedback
Security improvements
Performance enhancements
Features are prioritized based on customer impact and business value.
2.2 Development
Engineering teams develop product features in controlled development environments. Secure development practices are followed, including:
Version control
Code reviews
Branch management
Development environment segregation
2.3 Code Review
All code changes undergo peer review to ensure:
Code quality
Security best practices
Performance standards
Compliance with architecture guidelines
2.4 Testing
Multiple testing layers are performed before release:
Functional testing
Regression testing
Performance testing
Integration testing
Where applicable, security checks and vulnerability scans are also conducted.
2.5 Staging Validation
Approved builds are deployed to staging environments that replicate production configurations. This allows teams to validate:
System stability
Integration compatibility
Feature behaviour
2.6 Production Release
Once validation is complete, releases are deployed to production environments through controlled deployment pipelines.
Deployment typically occurs during planned release windows to minimize service impact.
2.7 Post-Release Monitoring
After deployment, system monitoring tools track:
Performance metrics
Error logs
System availability
Any anomalies are investigated immediately.
2.8 Release Types
Minor Release
Bug fixes and small improvements
Feature Release
New features or enhancements
Emergency Release
Critical fixes such as security patches
Release notes and change logs are maintained for traceability.
3. Change Management
A structured change management process ensures that modifications to the system are implemented in a controlled and auditable manner.
3.1 Change Categories
Standard Changes
Routine operational updates with minimal risk.
Examples:
Minor configuration updates
System optimizations
Normal Changes
Planned system updates requiring internal review and approval.
Examples:
Feature updates
Infrastructure modifications
Emergency Changes
Urgent changes implemented to resolve critical issues such as system outages or security vulnerabilities.
3.2 Change Management Process
1. Change Request Initiation
o Internal change request logged
2. Impact Assessment
o Risk analysis conducted
o Technical impact reviewed
3. Approval
o Relevant technical stakeholders approve the change
4. Deployment Planning
o Release window defined
o Rollback plan prepared
5. Implementation
o Change deployed in production environment
6. Validation
o System performance verified
o Functionality confirmed
7. Documentation
o Change logs updated
o Records maintained for audit purposes
4. Incident Management
We360.ai follows a structured incident management framework to ensure that service disruptions are addressed quickly and effectively.
4.1 Incident Sources
Incidents may be identified through:
System monitoring alerts
Customer support reports
Internal engineering detection
Infrastructure monitoring tools
4.2 Incident Response Workflow
1. Incident detection
2. Incident logging
3. Severity classification
4. Investigation by engineering team
5. Issue resolution or mitigation
6. Root cause analysis
7. Preventive actions
4.3 Incident Severity Levels
Critical
Complete system outage
High
Major feature disruption
Medium
Partial functionality issue
Low
Minor issue or enhancement request
Critical incidents receive immediate attention from engineering teams.
5. Infrastructure & Cloud Hosting
We360.ai is hosted on secure cloud infrastructure designed for scalability, availability and reliability.
5.1 Infrastructure Characteristics
Cloud-native architecture
Scalable infrastructure resources
High availability configuration
Continuous system monitoring
5.2 Hosting Environment
We360.ai is hosted on secure cloud infrastructure with primary hosting located in India to support enterprise data residency expectations.
Infrastructure includes:
Secure networking layers
Firewall configurations
Access restrictions
Monitoring systems
5.3 Infrastructure Monitoring
Infrastructure monitoring tools track:
Server health
System availability
Resource usage
Error logs
Alerts are triggered if abnormal behaviour is detected.
6. Data Security & Privacy
Data security is a core operational priority.
6.1 Security Controls
Key security practices include:
Encryption of data in transit using secure protocols
Controlled access to infrastructure and administrative systems
Continuous monitoring of system activity
Logging and auditing mechanisms
6.2 Access Management
Access to We360.ai is governed through:
· Role-Based Access Control (RBAC): Users are assigned permissions based on their roles within the organization.
· Least Privilege Model: Users and administrators receive only the minimum access required to perform their responsibilities.
· Administrative Access: Administrative system access is restricted to authorized personnel and monitored through logging systems.
7. Business Continuity & Disaster Recovery
Business continuity processes ensure that We360.ai can continue operating even during unexpected disruptions.
7.1 Key Measures
Automated data backup procedures
Infrastructure redundancy
Disaster recovery planning
Operational monitoring
7.2 Backup Policy
System configurations and essential operational data are backed up regularly to ensure recoverability.
7.3 Disaster Recovery
In the event of infrastructure disruption:
1. Engineering teams investigate the failure
2. Recovery procedures are initiated
3. Services are restored using backup infrastructure
Periodic reviews ensure disaster recovery readiness.
8. Customer Onboarding
Customer onboarding is designed to allow new organizations to start using We360.ai quickly and efficiently.
8.1 Onboarding Steps
Step 1: Account Creation
Users register on We360.ai and verify their accounts.
Step 2: Organization Setup
Customers configure their organization profile and workspace.
Step 3: Onboarding Wizard
A guided onboarding wizard assists users with:
Initial configuration
Team member setup
System settings
Step 4: User Management
Administrators add team members and assign roles.
Step 5: System Setup
Customers configure productivity & team mapping role setting required for data collection.
Step 6: Data Synchronization
Once setup is complete, operational data begins appearing in We360.ai dashboard.
Documentation such as the 5-Minute Launch Guide helps users quickly understand We360.ai functionality.
9. Customer Support & Escalation
Customer support ensures that users receive assistance when needed.
9.1 Support Channels
Customers can reach support through:
Email support
Support ticket system
Customer success engagement
9.2 Support Escalation Model
Level 1
Customer Support Team
Level 2
Product Support Specialists
Level 3
Engineering Team
Critical issues are escalated immediately to engineering teams for investigation.
10. Vendor & Third-Party Management
We360.ai may utilize third-party service providers to support infrastructure and operations.
10.1 Vendor Categories
Typical vendors include:
Cloud infrastructure providers
External Auditors
Security tools
10.2 Vendor Evaluation
Before engaging with any vendor, the following factors are reviewed:
Security posture
Infrastructure reliability
Compliance standards
Operational stability
Vendor relationships are periodically reviewed to ensure ongoing compliance.
11. Compliance & Security Governance
Governance processes ensure alignment with enterprise operational and security expectations.
11.1 Governance Controls
The organization maintains documentation related to:
Product architecture
Security practices
Release history
Change logs
Operational procedures
These documents support enterprise:
Vendor risk assessments
Security reviews
Compliance audits
RFP evaluations
12. Continuous Improvement
We360.ai follows a continuous improvement approach to enhance reliability, security and customer experience.
12.1 Improvement Initiatives
Monitoring system performance
Reviewing incident trends
Implementing security improvements
Incorporating customer feedback
Enhancing operational processes
Regular internal reviews ensure We360.ai evolves to meet enterprise operational standards.
13. Security Certifications, Compliance & Regulatory Alignment
We360.ai follows industry-recognized security and privacy standards to ensure the protection of customer data and operational integrity. The organization aligns with globally accepted frameworks, regulatory requirements and security best practices.
These certifications and compliance programs demonstrate our commitment to maintaining enterprise-grade security, privacy protection and regulatory adherence.
13.1 Security Certifications
SOC 2 Type II
We360.ai maintains compliance with SOC 2 Type II, which validates that the organization's internal controls meeting the Trust Service Criteria.
SOC 2 Type II focuses on the following trust principles:
Security
Availability
Processing Integrity
Confidentiality
Privacy
The certification involves an independent audit that evaluates the effectiveness of security controls over a defined monitoring period. This ensures that security practices are not only designed appropriately but also operate effectively over time.
Key SOC 2 control areas include:
Access control management
Infrastructure monitoring
Change management
Incident response
Data protection controls
Vendor management
ISO/IEC 27001
We360.ai aligns with the ISO/IEC 27001 framework, which defines best practices for establishing and maintaining an Information Security Management System (ISMS).
ISO 27001 focuses on:
Risk management
Information security policies
Asset management
Access control
Cryptography
Incident management
Business continuity
This framework ensures a systematic approach to managing sensitive information and maintaining strong security governance practices.
ISO/IEC 27017
We360.ai aligns with ISO/IEC 27017, which provides additional security guidance specifically for cloud service providers and cloud-based systems.
Key areas covered include:
Cloud infrastructure security
Shared responsibility model
Virtual machine security
Cloud service configuration controls
Administrative access governance
This standard ensures that cloud deployments follow recognized best practices for protecting data and workloads in cloud environments.
ISO/IEC 27018
We360.ai follows privacy protection guidelines defined in ISO/IEC 27018, which focuses on protecting personally identifiable information (PII) in public cloud environments.
Key protections include:
Restrictions on data processing
Transparency in data handling
Customer data ownership protections
Secure deletion of data
Privacy-focused operational controls
13.2 Security Assessments
Vulnerability Assessment & Penetration Testing (VAPT)
We360.ai undergoes periodic Vulnerability Assessment and Penetration Testing conducted by qualified security professionals.
The objective of VAPT is to identify potential security weaknesses and proactively address them before they can be exploited.
The assessment typically includes:
Network vulnerability assessment
Application security testing
Infrastructure security review
Penetration testing simulations
Findings from these assessments are prioritized based on severity and remediated according to internal security policies.
Regular VAPT exercises help ensure We360.ai remains resilient against emerging security threats.
13.3 Privacy & Data Protection Regulations
We360.ai is designed to support compliance with major global privacy regulations governing the protection of personal data.
Digital Personal Data Protection Act 2023 (DPDP)
We360.ai aligns with the requirements of the Digital Personal Data Protection Act 2023, which governs the processing of digital personal data in India.
Key principles supported include:
Lawful data processing
User consent management
Data minimization
Secure storage and processing
Protection against unauthorized access
These measures help ensure compliance with India's evolving data protection landscape.
General Data Protection Regulation (GDPR)
We360.ai supports compliance with the General Data Protection Regulation, which governs the protection of personal data for individuals within the European Union.
GDPR compliance principles include:
Lawful processing of personal data
Transparency in data collection
Data minimization
Data subject rights
Security safeguards
Breach notification mechanisms
We360.ai incorporates controls that enable organizations to meet GDPR requirements when handling personal data.
California Consumer Privacy Act (CCPA)
We360.ai supports compliance with the California Consumer Privacy Act, which provides California residents with enhanced rights regarding the use of their personal data.
We360.ai enables organizations to support CCPA requirements including:
Data transparency
Consumer access rights
Data deletion requests
Data usage disclosures
Health Insurance Portability and Accountability Act (HIPAA)
For customers operating within healthcare ecosystems, We360.ai aligns with the principles of Health Insurance Portability and Accountability Act.
HIPAA focuses on protecting Protected Health Information (PHI) through:
Administrative safeguards
Physical safeguards
Technical safeguards
These protections help ensure the confidentiality, integrity and availability of sensitive healthcare data.
13.4 Ongoing Security Governance
Security and compliance controls are continuously monitored and improved through:
Periodic security assessments
Internal security reviews
Infrastructure monitoring
Access control audits
Incident response testing
Security training and awareness
The organization is committed to maintaining high standards of security and privacy to meet enterprise and regulatory expectations.
14. Data Protection & Data Flow Architecture
We360.ai follows a secure data architecture designed to protect customer information throughout its lifecycle. The architecture incorporates security controls at every stage of data handling, including collection, transmission, processing, storage and deletion.
The system architecture is designed following security frameworks such as SOC 2 Type II and ISO/IEC 27001.
14.1 Data Flow Overview
We360.ai processes data through the following controlled stages:
1. Data Collection
2. Data Transmission
3. Data Processing
4. Data Storage
5. Data Access & Usage
6. Data Retention & Deletion
Each stage incorporates encryption, authentication and monitoring mechanisms to protect data integrity and confidentiality.
14.2 Data Collection
Data is collected from customer systems using secure integration methods configured during onboarding.
Collection mechanisms may include:
Secure API integrations
Platform connectors or agents
System integrations configured by the customer
User inputs through the application interface
Data collection follows the principle of data minimization, meaning only the data required for platform functionality is collected.
Customer administrators retain control over integration configurations and permissions.
14.3 Data Transmission
All communication between customer environments and We360.ai is secured using encrypted protocols.
Transmission protections include:
HTTPS/TLS encrypted communication
Secure API authentication
Token-based authorization mechanisms
Network traffic monitoring
Encryption prevents interception, tampering, or unauthorized access during data transmission.
14.4 Data Processing
After transmission, data is processed within secured application environments.
Processing operations may include:
Data analysis
Monitoring operations
Event correlation
System analytics
Application services operate in isolated environments to ensure secure processing and prevent unauthorized cross-access.
Strict access control policies ensure internal systems only access required datasets.
14.5 Data Storage
Customer data is stored within secure cloud infrastructure environments.
Security controls for storage include:
Encryption of stored data
Access-controlled databases
Network segmentation
Infrastructure monitoring
Data is logically separated by tenant to ensure that one organization's data cannot be accessed by another.
14.6 Data Access Controls
Access to platform data is governed through Role-Based Access Control (RBAC).
User roles may include:
Organization Administrators
Operational Users
Read-Only Users
Permissions are granted according to job responsibilities following the least privilege principle.
Administrative system access is restricted to authorized personnel.
.7 Data Retention
Data retention policies define how long data is stored within We360.ai.
Retention periods depend on:
Operational requirements and Agreements
Customer configuration
Security monitoring needs
Regulatory requirements
Logs and operational data may be retained for monitoring, auditing and compliance purposes.
14.8 Data Deletion
Data deletion procedures are implemented when:
Data reaches the end of its retention period
Customers request deletion
Customer contracts terminate
Deletion processes may include:
Secure database deletion
Storage cleanup
Backup lifecycle expiration
These processes help ensure that customer data is not retained beyond required periods.
14.9 Monitoring & Data Protection Controls
Continuous monitoring is implemented to detect unauthorized activity or system anomalies.
Monitoring mechanisms include:
Infrastructure monitoring
Application log monitoring
Security alerts
Access activity tracking
Security events are handled through the incident management process.
14.10 Privacy Protection
We360.ai supports compliance with major privacy regulations including:
Digital Personal Data Protection Act
General Data Protection Regulation
California Consumer Privacy Act
Health Insurance Portability and Accountability Act
Privacy protections focus on secure data processing, transparency and protection of personal data.
15. Security Controls & Technical Safeguards
We360.ai implements a layered security model designed to protect systems and customer data from unauthorized access, misuse and security threats.
Security controls align with frameworks such as ISO/IEC 27001 and SOC 2 Type II.
15.1 Access Control
Access to systems and data is governed by strict identity and access management policies.
Controls include:
Role-Based Access Control (RBAC)
Least privilege access model
User authentication mechanisms
Administrative access restrictions
Access rights are reviewed periodically to ensure that users retain only necessary permissions.
Administrative access to production systems is limited to authorized personnel.
15.2 Authentication & Identity Management
User identity verification is implemented through secure authentication mechanisms.
These include:
Secure login authentication
Password policy enforcement
Session management controls
Access revocation procedures for inactive users
Identity verification helps ensure that only authorized users access We360.ai.
15.3 Encryption Controls
Encryption protects sensitive data during transmission and storage.
Encryption measures include:
Encryption in Transit
TLS-based encrypted communication
Secure API connections
Encryption at Rest
Encrypted database storage
Secure storage configurations
Infrastructure-level encryption controls
These encryption practices prevent unauthorized access to stored or transmitted data.
15.4 Logging & Audit Trails
Logging systems capture activity across We360.ai to support monitoring, troubleshooting and security investigations.
Logged events may include:
User authentication events
Administrative activities
System configuration changes
Access attempts
Security alerts
Logs are retained for operational monitoring and compliance purposes.
Audit trails help maintain accountability and transparency within We360.ai.
15.5 Security Monitoring
Security monitoring systems continuously observe platform activity to identify potential threats.
Monitoring capabilities include:
Infrastructure health monitoring
Application monitoring
Security alerting
Log analysis
Alerts are generated for suspicious activities and investigated by engineering teams.
15.6 Vulnerability Management
We360.ai maintains a proactive vulnerability management process.
Security activities include:
Regular vulnerability scanning
Periodic Vulnerability Assessment and Penetration Testing
Security patching
Risk prioritization and remediation
Security findings are reviewed and remediated based on severity levels.
5.7 Incident Response
Security incidents are managed through a defined incident response process.
The process includes:
1. Detection of security events
2. Incident classification
3. Investigation and containment
4. Resolution and recovery
5. Root cause analysis
Security incidents are handled in accordance with internal incident management procedures.
15.8 Security Governance & Continuous Improvement
Security controls are continuously reviewed and improved through:
Security audits
Compliance assessments
Infrastructure monitoring
Incident trend analysis
Security awareness initiatives
These measures ensure that We360.ai maintains a strong and evolving security posture.
16. Risk Management & Security Governance Framework
The organization follows a structured risk management and security governance framework to ensure that information security risks are identified, assessed and mitigated in a systematic manner.
The framework aligns with industry standards such as ISO/IEC 27001 and incorporates security best practices to protect systems, infrastructure and customer data.
Security governance ensures that policies, procedures and controls are continuously reviewed and improved to maintain a strong security posture.
16.1 Information Security Governance
Information security governance establishes the policies and responsibilities required to manage and protect organizational information assets.
Key governance principles include:
Defined security policies and procedures
Role-based responsibilities for security management
Security oversight and accountability
Periodic review of security controls
Alignment with regulatory and compliance requirements
Security governance helps ensure that security controls remain effective and aligned with business and regulatory expectations.
16.2 Risk Management Process
A formal risk management process is followed to identify and mitigate risks associated with information systems and infrastructure.
The risk management lifecycle includes the following stages:
Risk Identification
Potential risks are identified through:
· Security assessments
· Infrastructure reviews
· Vulnerability scans
· Incident analysis
· Vendor assessments
Risk Assessment
Identified risks are evaluated based on:
· Likelihood of occurrence
· Potential impact on systems or data
· Exposure to operational disruption
Risk Mitigation
Appropriate mitigation strategies are implemented, including:
· Security controls
· Process improvements
· Infrastructure safeguards
· Monitoring mechanisms
Risk Monitoring
Risks are continuously monitored to ensure controls remain effective.
Periodic reviews are conducted to reassess risks and update mitigation strategies.
16.3 Security Policies & Standards
The organization maintains documented security policies that guide operational and security practices.
Key policy areas include:
Information security policy
Access control policy
Data protection policy
Incident response policy
Change management policy
Vendor management policy
Acceptable use policy
These policies establish the security framework for managing and protecting organizational assets.
16.4 Security Risk Assessments
Regular security assessments are conducted to identify vulnerabilities and evaluate the effectiveness of existing controls.
Security assessments may include:
Internal security reviews
Infrastructure security assessments
Application security testing
Threat analysis
Periodic Vulnerability Assessment and Penetration Testing is performed to detect potential vulnerabilities and strengthen We360.ai’s security posture.
Findings are prioritized based on severity and remediated through defined security processes.
16.5 Security Awareness & Training
Security awareness programs help ensure that employees understand their responsibilities in protecting organizational systems and data.
Training initiatives may include:
Security awareness training
Data protection best practices
Secure system usage guidelines
Phishing and social engineering awareness
These programs help reduce risks caused by human error and strengthen the overall security culture.
16.6 Vendor Risk Management
Third-party vendors that support infrastructure or operational services are evaluated to ensure they meet security and reliability standards.
Vendor risk assessments may include evaluation of:
Security posture
Compliance certifications
Infrastructure reliability
Data protection practices
Vendor relationships are periodically reviewed to ensure continued compliance with security expectations.
16.7 Compliance Monitoring
Security and compliance controls are regularly reviewed to ensure adherence to industry standards and regulatory requirements.
We360.ai supports compliance with frameworks such as:
SOC 2 Type II
ISO/IEC 27001
ISO/IEC 27017
ISO/IEC 27018
Compliance activities include:
Security audits
Policy reviews
Control testing
Continuous monitoring
16.8 Continuous Security Improvement
The organization follows a continuous improvement approach to maintain and enhance its security posture.
Security improvements are driven by:
Incident reviews
Security audit findings
Vulnerability assessments
Emerging threat intelligence
Customer feedback and enterprise security reviews
These practices ensure that the security program evolves to address new risks and maintain alignment with global security standards.
17. Secure Software Development Lifecycle (SSDLC)
The organization follows a Secure Software Development Lifecycle (SSDLC) to ensure that security is integrated throughout the entire software development process. Security practices are incorporated from the initial design stage through development, testing, deployment and ongoing maintenance.
The SSDLC framework ensures that security risks are identified early, vulnerabilities are minimized and secure coding practices are consistently followed.
17.1 Security by Design
Security considerations are incorporated during the initial stages of product design and architecture planning.
Key design practices include:
Threat modeling and risk identification during design stages
Secure architecture planning
Data protection and privacy considerations in system design
Implementation of least-privilege access principles
Secure API design and authentication mechanisms
By addressing security at the design stage, potential vulnerabilities can be prevented before development begins.
17.2 Secure Development Practices
Developers follow established secure coding guidelines to minimize vulnerabilities within application code.
Secure development practices include:
Use of secure coding standards
Input validation and output encoding
Protection against common web vulnerabilities
Proper error handling and logging
Secure configuration management
Development environments are controlled and separated from testing and production environments to prevent unauthorized access.
17.3 Code Review & Version Control
All application code is maintained in version-controlled repositories and undergoes peer review before being merged into the main codebase.
Code review processes help ensure:
Adherence to coding standards
Security best practices
Code quality and maintainability
Identification of potential vulnerabilities
Version control systems maintain a history of changes, ensuring traceability and accountability for all modifications.
17.4 Security Testing
Security testing is integrated into the development and testing lifecycle to identify vulnerabilities before software is released.
Testing activities may include:
Application security testing
Static code analysis
Dynamic testing of application behavior
Dependency vulnerability checks
In addition, periodic Vulnerability Assessment and Penetration Testing may be conducted to evaluate the security posture of We360.ai.
Security issues discovered during testing are documented and remediated according to defined severity levels.
17.5 Environment Segregation
To maintain system integrity and security, the organization maintains separate environments for:
Development
Testing
Staging
Production
This separation ensures that development activities do not affect production systems and helps prevent unauthorized code from reaching live environments.
Access to production environments is restricted to authorized personnel.
17.6 Secure Deployment
Deployment processes follow controlled procedures to ensure that only approved and tested code is released into production environments.
Deployment controls include:
Automated deployment pipelines where applicable
Controlled release management processes
Approval mechanisms for production releases
Rollback procedures in case of deployment issues
Deployment logs are maintained to track system changes and maintain auditability.
17.7 Dependency & Vulnerability Management
Software dependencies and third-party libraries are monitored to ensure they remain secure.
Dependency management practices include:
Tracking third-party libraries and components
Monitoring known vulnerability databases
Applying security updates and patches when required
Regular updates help reduce exposure to vulnerabilities present in external libraries.
17.8 Security Incident Handling
If vulnerabilities or security issues are identified within the application, they are addressed through the organization’s incident management and vulnerability management processes.
The process includes:
1. Identification of the security issue
2. Risk and severity assessment