Governance &
Security

Governance built into the workflow, not bolted on

Enterprise workflow automation only scales when the people who answer for it can see and control it. Governance on the platform is not a separate product or a report you run at the end of the quarter: the same layer that routes a request also decides who may act on it, records what they did and keeps that record for review.

That matters most in the processes automation touches first, such as approvals, procurement, onboarding and compliance checks, where a missing signature or an untraceable change is a finding, not an inconvenience.

Role-based access control with least privilege

Permissions are granted by role, team and organizational unit, and they are fine-grained: who can design a process, who can deploy it, who can start it and who can only read its results are separate decisions. Access follows the principle of least privilege, and it is enforced by the platform rather than assumed by convention.

Because roles are defined once and reused, a change in responsibilities is a change to one role, not a hunt through every workflow that person ever touched.

Organization hierarchies and separated tenants

Large organizations are not flat. Organization hierarchies let subsidiaries, regions and departments share the platform while each keeps its own users, data and processes, with multi-tenant support so one unit never sees another unit’s records by accident.

An audit trail you can hand to an auditor

Every step of a governed flow captures who did what, when and why. The result is complete traceability from the first request to the final approval, readable by the people who have to defend the process, whether that is internal audit, a regulator or a customer’s security review.

Encryption and hardened access

Personal data is encrypted in transit and at rest, and the systems run in AWS secure data centres. Risks to personal data are assessed and managed continuously, there is a formal incident response plan, and third-party providers go through due diligence and ongoing monitoring. Security and privacy are part of product design, not added afterwards.

Controlled releases

Governance does not stop at runtime. Applications carry a clear version history, are validated in lower environments before promotion, and can be rolled back, so a change reaches production only after it has been tested and approved.

Certified, and committed to in the contract

The information security and privacy management behind these controls is certified to ISO/IEC 27001 and ISO/IEC 27701, and both certificates can be downloaded in full. The agreements put numbers on it: 99.9% monthly availability (Terms of Use, clause 8.1), breach notification within 72 hours (Data Processing Agreement, clause 11.3), 60 days to retrieve your data (Terms of Use, clause 13) and six named sub-processors (Data Processing Agreement, Annex 1).

The questions a security review asks, answered in one place

Where does the data live? In AWS secure data centres. Who else processes it? Six companies, named with their country and purpose in Annex 1 of the Data Processing Agreement: Amazon Web Services for platform hosting, Coralogix for log files, Zoho for support ticketing, Google for staff email, and Hyverr and PurpleTalk for second- and third-level support.

How would we hear about a breach? Within 72 hours, by contract. What happens if we leave? You have 60 days to retrieve your data. Who is trained to handle it? Everyone on staff trains on security and privacy obligations, on a schedule. Each answer points at a document your legal and security teams can open and check, rather than at a badge.