Security at Workiflow.

• 

  SOC 2 Type II

  Certified · Apr–Jul 2026 · report under NDA

  The AICPA attestation for independently audited controls. Our SOC 2 Type II examination covers the Security trust services criterion for the period April 20 to July 20, 2026, and received an unqualified opinion from Prescient Assurance.

• 

  ISO 27001

  Coming soon · audit in progress

  The international standard for information security management systems (ISMS). Our ISO 27001 program is in progress.

How we protect your data

The controls, grouped into six areas.

• Access Controls

  Role-based access with least-privilege enforcement. Team members only access the systems and data they need for their specific role, nothing more.

• Encryption

  Data is encrypted in transit (TLS 1.2+) and at rest. We enforce encryption standards across every system and integration we manage.

• Continuous Monitoring

  Active vulnerability monitoring and threat detection powered by At-Bay Stance, our embedded security platform, keeping our environment under constant watch.

• Incident Response

  A documented incident response plan with defined roles, escalation paths, and communication protocols. If something happens, we move fast and transparently.

• Vendor & Platform Security

  We vet every platform and tool in our stack against security, compliance, and data handling standards before it touches client data.

• Employee Security Training

  Regular security awareness training and phishing simulations for all team members. Human error is the biggest attack vector. We take it seriously.

See the full register of 69 continuously monitored controls behind these six areas

Insurance and liability

Insurance cover for the work we deliver.

• Errors & Omissions InsuranceComprehensive professional liability coverage protecting against claims arising from errors, omissions, or negligence in the technology services we deliver.
• Comprehensive Cyber LiabilityCoverage including data breach response, network security liability, regulatory defense, business interruption, ransomware events, and incident recovery costs.

Transparency

The SOC 2 report is available under NDA.

The SOC 2 Type II examination covered the period April 20 to July 20, 2026 and received an unqualified opinion from Prescient Assurance. We share the full report with prospective and current clients under NDA. If you are evaluating Workiflow or running a vendor security review, email the security team and we send it. The ISO 27001 audit is still in progress.