Security approach
Data encryption at rest and in transit, tenant isolation with row-level security, minimal personal-data processing and audit logs. Access is role-based and need-to-know.
Trust center
How Workvin protects your data — transparently and honestly.
EU data residency
Primary storage and backups are in the EU region (Hetzner, DE/FI). Some sub-processors (e.g. push notifications) are outside the EU — cross-border transfers use a legal mechanism (SCC/adequacy). See the sub-processors registry.
Sub-processors
The current list of third-party processors with processing region and legal mechanism is maintained in a single source.
Availability and status
Real-time service status and incident history are available on an independent status-page. Actual uptime is computed from observability data.
Target availability (SLO): 99.9% per month
Certifications — honest status
We do not claim certifications we do not hold. Current status:
- GDPR compliance — an ongoing process (DPA available, sub-processors registry maintained).
- SOC 2 — planned after product-market fit (audit not yet started).
- ISO/IEC 27001 — planned (no certification yet).
Security contacts
For security questions and vulnerability disclosure, write to:
Status last updated: 2026-07-12.