Whatfix

Founded in 2014

Your Security Is Our Priority

At Whatfix, protecting the confidentiality, integrity, and availability of customer data is central to the design and operation of our DAP services. Security and privacy are embedded throughout the SaaS lifecycle, from development through ongoing operations.

Our program is supported by industry-recognized frameworks, strong technical and organizational controls, and continuous monitoring to safeguard data against unauthorized access, disclosure, alteration, and loss. We operate under a shared responsibility model and support our customers in meeting applicable regulatory and data protection requirements.

This Trust Center provides transparency into our security, privacy, and compliance practices, including relevant policies, certifications, and documentation.

**Note: All documents, materials, and information accessed through this Trust Center are Confidential and subject to the terms of your Non-Disclosure Agreement (NDA) with Whatfix. By accessing this content, you agree to handle all information responsibly and not disclose it to unauthorized parties.*

Founded in 2014

Controls (51)

Here are the controls implemented at Whatfix to ensure compliance, as a part of our security program.

Product security (5)

Role Based Access Controls

Audit Logging

Data Security

Service Level Agreement

Single Sign On

Data security (5)

Access Monitoring

Backups Enabled

Encryption at Rest

Encryption in Transit

Physical Security

Network security (5)

Data Loss Prevention

Firewall

IDS/IPS

Wireless Security

Cloud Access Security Broker (CASB)

App security (7)

Conspicuous Link To Privacy Notice

Entity displays the most current information about its services on its website, which is accessible to its customers.

Vulnerability Disclosure Program

Code Analysis

Software Development Life Cycle

Credential Management

Vulnerability & Patch Management

Web Application Firewall

Corporate security (29)

Code of Business Conduct

Entity has a documented policy to define behavioral standards and acceptable business conduct.

Roles & Responsibilities

Entity has established procedures to communicate with staff about their roles and responsibilities.

Competency Screening

Entity has procedures to ensure that all security-related positions are staffed by qualified individuals who have the necessary skill set.

Personnel Screening

Entity has established procedures to perform security risk screening of individuals before authorizing access.

Security & Privacy Awareness

Entity provides information security and privacy training to staff that is relevant to their job function.

Performance Review

Entity requires that all employees in client serving, IT, Engineering, and Information Security roles are periodically evaluated regarding their job responsibilities.

Automated Reporting

Entity has provided information to employees, via various Information Security Policies/procedures, on how to report failures, incidents, concerns, or other complaints related to the services or systems provided by the entity in the event there are problems.

Incident Reporting Assistance

Entity has provided information to customers on how to report failures, incidents, concerns, or other complaints related to the services or systems provided by the Entity in the event there are problems.

Risk Framing

Entity performs a formal risk assessment exercise annually, as per documented guidelines and procedures, to identify threats that could impair systems' security commitments and requirements.

Risk Assessment

Each risk is assessed and given a risk score in relation to the likelihood of it occurring and the potential impact on the security, availability, and confidentiality of the Company platform. Risks are mapped to mitigating factors that address some or all of the risk.

Fraud

Entity considers the potential for fraud when assessing risks. This is an entry in the risk matrix.

Third-Party Criticality Assessments

Entity performs a formal vendor risk assessment exercise annually to identify vendors that are critical to the systems' security commitments and requirements.

Assigned Cybersecurity & Privacy Responsibilities

Entity's Senior Management assigns the role of Information Security Officer who is delegated to centrally manage, coordinate, develop, implement, and maintain an enterprise-wide cybersecurity and privacy program.

Subservice organization evaluation

Entity reviews and evaluates all subservice organizations periodically, to ensure commitments to Entity's customers can be met.

Subprocessor Requirements

Entity ensures that appropriate remediation measures are in place when personal data is shared with vendors as a part of its processing activities

Data Protection Impact Assessment (DPIA)

Entity conducts Data Protection Impact Assessments periodically in order to assess the regulatory risks associated with the processing of personal data

Data Protection Officer (DPO)

Entity appoints a Data Protection Officer to assess and facilitate the entity's compliance with the provisions of the GDPR

Chief Privacy Officer (CPO)

Entity appoints a Privacy Officer to assess and facilitate the entity's compliance with relevant regulatory requirements.

Incident Handling

Entity uses an Incident Management System to ensure a 24/7 on-call response to manage incidents.

Privacy Act Statements

Entity includes Privacy Act statements on forms that collect information that will be maintained in a Privacy Act system of records, or provide Privacy Act statements on separate forms that can be retained by individuals.

Asset Ownership Assignment

Entity has set up mechanisms to assign and manage asset ownership responsibilities and establish a common understanding of asset protection requirements.

Validate Security Controls

The Entity assesses and validates the controls implemented by critical Cloud Service Providers for the protection of data collected and stored by the Cloud Service Provider.

Review of Third-Party Services

The Entity requests an external security certification of an independent audit report of the implemented and claimed information security controls for all critical Cloud Service Providers.

Inventory of Endpoint Assets

Entity develops, documents, and maintains an inventory of organizational endpoint systems, including all necessary information to achieve accountability.

Email Protection

Employee Training

Incident Response

Internal Assessments

Single Sign On

Create your own Trust Center | Powered by