- Home
- Security and trust
Security and trust
Software that keeps changing has to prove it is under control.
Adaptability and telemetry are the two things a security team will challenge first, and they are right to. This page sets out what BetterWrk holds, how tenants are separated, what ProcessScout collects and how a change is allowed to reach production.
Data
Ownership, isolation and residency.
- Data ownership
- Your data is yours. BetterWrk processes it to provide the service and does not sell it, share it with other customers, or use one customer’s business data to build features for another.
- Tenant isolation
- Every customer environment is logically separated at the data layer, and access is scoped by tenant at the application layer. Customer-specific changes are isolated behind per-tenant feature gates, so a change built for one organisation cannot appear in another’s environment.
- Data residency
- Selected at the environment level and documented in your agreement, including every subprocessor and where it operates.
- Encryption
- In transit using current TLS, and at rest for stored data and backups. Key management is documented in the security pack.
- Backups and recovery
- Backed up on a defined schedule with tested restoration. Recovery objectives are stated in your agreement rather than implied.
- Export and exit
- Your data and configuration are exportable in a documented format throughout the relationship, not only at the end of it.
ProcessScout telemetry
The part that deserves the hardest questions.
A system that observes how people work can become a surveillance tool. ProcessScout is designed so that it cannot, because a workforce that does not trust it would stop telling it the truth — and the truth is the entire product.
Semantic telemetry, not screen capture
ProcessScout records which workflow step occurred, on which record type, how long it took and what failed. It does not log keystrokes or capture general desktop activity.
Sensitive-data masking
Pay, health, bank details and personal identifiers are masked before analysis. Knowing a step was slow does not require knowing the salary involved.
Workforce-monitoring principles
The unit of analysis is a workflow. There is no individual productivity score, no activity ranking and no idle-time measurement, and we will not build one.
Customer controls
Observation scope, retention period and which areas are in or out are yours to set. It can be paused or switched off by area.
Transparency to users
People can see that ProcessScout is active. Contextual feedback is a prompt they may decline, and declining has no consequence.
Retention
Telemetry retention is set per environment and enforced. Evidence supporting a released change is retained with the change record.
Identity and access
Who can reach what, including us.
Your users
- Single sign-on with your existing identity provider, with SCIM-style provisioning where you use it
- Multi-factor authentication enforced by policy
- One permission model covering roles, entities, data scopes and approval authority
- Sensitive domains — pay, health, financial — scoped separately from general access
- Session and device controls set at environment level
BetterWrk staff
- Least-privilege access, granted for a reason and time-bound
- Production access is logged and reviewable by you
- Support access to customer data requires justification and is auditable
- Background-checked personnel with role-appropriate training
- Access revoked immediately on role change or departure
Secure development and change
How a change is allowed to reach your environment.
This is the control set that makes continuous improvement safe rather than alarming.
Repository access controls
Source access is governed, reviewed and logged. Changes require review by a person who did not write them.
Requirement linkage
A material change exists against an agreed requirement, so an unexplained change cannot enter the pipeline.
Automated and human review
Automated tests, security scanning and dependency checks, plus human review before a change is eligible for release.
Approval requirements
Payroll, finance, permissions and contract logic require your named approver in addition to BetterWrk sign-off.
Feature gates
Every customer-specific change is gated per tenant. Scope is explicit rather than assumed.
Rollback
Withdrawing a change is a switch. Monitoring after release is part of the release, not an optional extra.
Supply chain
Open source we are accountable for.
Using open source is not a risk in itself. Using it without knowing what you are running is.
- Open-source components are distributed as BetterWrk-certified builds: pinned, patched and supported by us
- A software bill of materials is available to your security and procurement teams
- Open-source notices and licence obligations are published and maintained
- Dependencies are scanned continuously, with remediation timelines by severity
- Subprocessors are listed, with what each one processes and where
Operations
Vulnerabilities and incidents.
What we do when something is wrong matters more than the claim that nothing ever will be.
- Vulnerability management with defined severity-based remediation targets
- Independent testing, with summary results available under NDA
- A documented incident response process with defined customer notification obligations
- Security fixes never consume your Fit Capacity — they are our obligation, not your allowance
- Status and incident history available to customers
Certifications
We do not display badges we do not hold.
Plenty of software companies decorate a trust page with certification logos that belong to a hosting provider, or that describe an audit still in progress. We would rather tell you our exact position in writing.
Ask, and you will get the current certification status, what is in progress, the target scope and the expected timing — along with the security pack, subprocessor list, software bill of materials and independent test summaries under NDA.
For your due-diligence questionnaire
Send it. We complete security questionnaires as part of evaluation rather than treating them as an obstacle, and we will tell you where an answer is “not yet” rather than dressing it up.
Available on request
- Security overview and control documentation
- Subprocessor list and data-flow description
- Software bill of materials
- Independent test summary
- Incident response and business continuity summary
- Data processing agreement and residency options
Bring your security team early.
The questions on this page are better asked at evaluation than at contract. We will answer them in writing.