> For the complete documentation index, see [llms.txt](https://docs.we360.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.we360.ai/reference/trust-and-compliance.md). # Trust & Compliance At We360.ai, we believe that world-class workforce analytics must be built on a foundation of absolute trust, security, and transparency. As the leading platform for employee productivity and workforce optimization, we have engineered our infrastructure from the ground up to protect your organization’s most sensitive data. We balance powerful operational insights with uncompromising data protection, ensuring peace of mind for both leadership and employees. Here is an overview of the rigorous security measures, compliance standards, and architectural safeguards that make We360.ai a trusted partner for over 7,000 global companies. *** ### 1. Global Compliance & Certifications We adhere to the most stringent international compliance standards to ensure your data is handled with the highest level of legal and regulatory integrity. * SOC 2 Type II: We have successfully undergone rigorous auditing to demonstrate our ongoing commitment to the five trust service principles: security, availability, processing integrity, confidentiality, and privacy. * HIPAA Compliant: For our partners in the healthcare sector, we maintain strict adherence to the Health Insurance Portability and Accountability Act, ensuring all health data privacy and security requirements are fully met. * ISO 27001 Certified: Our information security management systems are certified against the premier international standard for data security, minimizing risk and maximizing proactive defense. * GDPR Compliant: We ensure full compliance with European Union data protection regulations, protecting Personally Identifiable Information (PII) and guaranteeing your users' right to privacy. ### 2. Unbreakable Data Protection & Encryption We utilize robust, industry-standard cryptographic protocols to ensure your information is indecipherable to unauthorized entities. * Data at Rest: All stored data is secured using industry-standard AES-256 or equivalent encryption. * Data in Transit: All communication between your devices and our servers is heavily protected using industry-standard TLS/SSL encryption. * Strict Access Controls: Customer data is encrypted at rest with KMS-managed keys, and operational access to customer content is restricted to authorized personnel, protected by MFA, logged, and audited. For organizations requiring full custody of their data and keys, on-premise and Bring-Your-Own-Cloud deployments keep all monitoring data entirely within your own infrastructure. ### 3. Secure Software Development Life Cycle (SDLC) Security is not an afterthought; it is woven directly into how we write, test, and deploy our code. * End-to-End Secure SDLC: We maintain a strictly controlled and secure SDLC flow from initial design to final deployment. * Continuous Scanning: Automated, regular code scanning is a mandatory part of our SDLC, preventing vulnerabilities from ever reaching production. * Thorough Review Process: Every release undergoes rigorous peer and security reviews to guarantee structural integrity. * Vulnerability Assessment and Penetration Testing (VAPT): We conduct multiple, aggressive rounds of penetration testing throughout the year, supplemented by comprehensive annual third-party pen testing to fortify our defenses against emerging threats. ### 4. Advanced Infrastructure & Network Security Our platform operates on a multi-cloud fortress designed for maximum uptime, scalability, and threat prevention. * Cloud-Native Scanning: Hosted on top-tier infrastructure, we leverage advanced Cloud-Native scanning (AWS) to automatically detect, assess, and mitigate infrastructure vulnerabilities in real-time. * Cloudflare WAF: We route our traffic through a powerful Web Application Firewall (WAF) powered by Cloudflare, ensuring immediate protection against DDoS attacks, SQL injections, malicious bot traffic, and other zero-day exploits. * Continuous Monitoring: Our enterprise data centers feature 24/7 continuous system auditing and monitoring to detect anomalies and respond to potential threats instantly. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.we360.ai/reference/trust-and-compliance.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.