At Workday, trust is woven into the fabric of everything we do. To keep your data safe and private, we deploy industry-leading safeguards and continuously monitor our system, so you can rest easy knowing your most sensitive data is protected 24/7 in the cloud.
At Workday, our top priority is keeping our customers' data secure. We employ rigorous security measures at the organizational, architectural, and operational levels to ensure that your data, applications, and infrastructure remain safe.
Security begins on day one here. All employees receive security, privacy, and compliance training the moment they start. Though the extent of involvement may vary by role, security is everybody’s responsibility at Workday.
This commitment to security extends to our executives. The Workday Security Council, a cross-functional group of executives spanning the enterprise, shapes our security programs, drives executive alignment across our organization, and ensures that security awareness and initiatives permeate throughout our organization.
Our customers serve as the data controller while Workday is the data processor. This means that you have full control of the data entered into services, as well as all setup and configurations. Because you control your data—and we only process it—you won’t have to rely on us to perform day-to-day tasks such as:
Workday encrypts every attribute of customer data before it’s persisted in a database. This is a fundamental design characteristic of the Workday technology. Because Workday is an in-memory, object-oriented application instead of a disk-based RDBMS, we can achieve the highest level of encryption. We use the Advanced Encryption Standard (AES) algorithm with a key size of 256 bits and a unique encryption key for each customer.
Transport Layer Security (TLS) protects user access via the internet, helping to secure network traffic from passive eavesdropping, active tampering, or message forgery. File-based integrations can be encrypted via PGP or a public/private key pair generated by Workday, using a customer-generated certificate. WS-Security is also supported for web services integrations to the Workday API.
Workday security access is role-based, supporting LDAP Delegated Authentication, SAML for single sign-on, and x509 certificate authentication for both user and web services integrations.
Single-Sign-On Support
SAML allows for a seamless, single-sign-on experience between the customer’s internal web portal and Workday. Customers log in to their company’s internal web portal using their enterprise username and password and are then presented with a link to Workday, which automatically gives customers access without having to log in again. Workday also supports OpenID Connect.
Workday Native Login
For customers who wish to use our native login, Workday only stores our Workday password in the form of a secure hash as opposed to the password itself. Unsuccessful login attempts are logged as well as successful login/logout activity for audit purposes. Inactive user sessions are automatically timed out after a specified time, which is customer configurable by user.
Customer configurable password rules include length, complexity, expiration, and forgotten password challenge questions.
Multifactor Authentication
We recommend that customers use multifactor authentication (MFA). Workday allows customers to bring in their own MFA provider that is backed by the TOTP (time-based one-time passcode) algorithm. With this setup, customers can easily integrate MFA providers with the native Workday login. Workday also allows end users of customers to receive a one-time passcode delivered via an email-to-SMS gateway mechanism. Lastly, Workday supports challenge questions as an additional mechanism to prove a user’s identity.
Step-Up Authentication
If someone leaves their console open or multiple users access Workday from the same device, organizations that use SAML as an authentication type can secure against unauthorized access by identifying critical items within Workday. This allows customers to force a secondary authentication factor that users must enter to access those items.
Workday applications are hosted in state-of-the-art data centers designed to protect mission-critical computer systems with fully redundant subsystems and compartmentalized security zones. Our data centers adhere to the strictest physical security measures including, but not limited to, the following:
All physical access to the data centers is highly restricted and stringently regulated.
Workday has established detailed operating policies, procedures, and processes designed to help manage the overall quality and integrity of the Workday environment. We’ve also implemented proactive security procedures, such as perimeter defense and network intrusion prevention systems (IPSs).
Network IPSs monitor critical network segments for atypical network patterns in the customer environment as well as traffic between tiers and service. We also maintain a global Security Operations Center 24/7/365.
Workday has implemented an enterprise Secure Software Development Life Cycle (SDLC) to help ensure the continued security of Workday applications.
This program includes an in-depth security risk assessment and review of Workday features. In addition, both static and dynamic source code analyses are performed to help integrate enterprise security into the development lifecycle. The development process is further enhanced by application security training for developers and penetration testing of the application.
Workday contracts with third-party expert firms to conduct independent internal and external network, system, and application vulnerability assessments.
Application
We contract with a leading third-party security firm to perform an application-level security vulnerability assessment of our web and mobile application prior to each major release. The firm performs testing procedures to identify standard and advanced web application security vulnerabilities, including, but not limited to, the following:
Network
External vulnerability assessments scan all internet-facing assets, including firewalls, routers, and web servers for potential weaknesses that could allow unauthorized access to the network. In addition, an authenticated internal vulnerability network and system assessment is performed to identify potential weaknesses and inconsistencies with general system security policies.
Data privacy regulations are complex, vary from country to country, and impose stringent requirements. When choosing an HCM, finance, or other application, businesses should select one that enables customers to comply with their data protection obligations and protect the privacy of their data. With Workday, you gain leading privacy functionality and practices that enable you to meet your privacy obligations.
Additionally, we provide our customers with the necessary resources and information to help them understand and validate the privacy and compliance requirements for their organization, as well as show how Workday can help power their compliance efforts.
Workday founded our privacy program on strict policies and procedures regarding access to and the use, disclosure, and transfer of customer data. The core of our privacy program is that Workday employees do not access, use, disclose, or transfer customer data unless it is in accordance with a contractual agreement or at the direction of the customer.
As data protection issues and global laws continue to evolve and become increasingly complex, Workday understands the importance of a privacy program that is embedded into our company's culture and services. Our philosophy of Privacy by Design is a testament to this and provides our customers with the assurance they need for the privacy and protection of their data.
The Workday Privacy, Ethics, and Compliance team, led by our Chief Privacy Officer, manages the privacy program and monitors its effectiveness. The team is responsible for:
Privacy and data protection require year-round vigilance, and we’re strongly committed to protecting the personal data of our customers and employees. Read more about how we embrace the key principles of privacy here.
Review our privacy policy to learn more about how we manage and protect our customers’ information.
We’ve embedded a holistic privacy program into our services, from initial design through release. This program, built on our philosophy of Privacy by Design, guides how we develop products and operate our services.
We provide transparency into the geographical regions where our customers’ data is stored and processed.
Workday and our customers must comply with various global privacy laws and regulations. Common privacy principles throughout jurisdictions include notice, choice, access, use, disclosure, and security. Our application is designed to allow you to achieve differentiated configurations so you can meet your country’s specific laws. Workday also achieves compliance with international privacy regulations by maintaining a comprehensive, written information-security program that contains technical and organizational safeguards designed to prevent unauthorized access to and use or disclosure of customer data. Workday remains committed to global privacy standards, as shown by our dedication to programs such as the Privacy Shield, implementation of Binding Corporate Rules (BCR), and Asia-Pacific Economic Cross-Border Privacy Rules.
The EU data privacy landscape has changed significantly due to the General Data Protection Regulation (GDPR), which took effect on May 25, 2018. The GDPR has harmonized the patchwork of data protection laws in Europe. Workday is confident that we can continue to process our customers’ personal data in alignment with the GDPR, and we are monitoring guidance that EU supervisory authorities issue on the subject. If any changes are required, we will move quickly to address them.
Workday evaluated GDPR requirements and evaluated our numerous privacy and security practices to ensure compliance with the GDPR from day one. These included:
Privacy by Design and Privacy by Default are concepts deeply enshrined in the Workday Service. Workday recognizes that GDPR is a very important business priority for our global customers. As such, Workday continues to monitor guidance that EU supervisory authorities issue on GDPR to ensure that our compliance program remains up-to-date.
Workday understands that not only is it important for our own organization to be compliant with GDPR as a data processor, but also for our customers to be able to use the Workday Service to help with their internal compliance requirements. This is why Workday offers tools to help meet their Customers’ GDPR obligations. The Workday Service enables customers to process personal data within their own private tenant. You can learn more about how we enable our customers to meet their GDPR obligations here.
In 2016, Workday signed up for the Privacy Shield on the first day the U.S. Department of Commerce launched the Privacy Shield certification process, demonstrating our strong, ongoing commitment to privacy and protecting our customers’ data. The Privacy Shield is a data transfer framework to allow personal data transfers between the EU and the U.S., as well as between Switzerland and the U.S. Four key principles are emphasized in the Privacy Shield:
While companies can self-certify to the Privacy Shield, Workday uses TRUSTe as our third-party verification method. In addition, Workday continues to have third parties review our data privacy program regularly to ensure that our customers enjoy the highest possible levels of data protection and privacy. Read more about our certification to the Privacy Shield here.
In addition to self-certifying to Privacy Shield, Workday received approval for its Processor BCR from the European data protection authorities. The Irish Data Protection Authority was the lead authority for Workday, given its EU headquarters in Dublin. The data protection authorities in the UK and the Netherlands were acting as co-lead authorities. Workday’s BCR commitments to data subjects of our customers are available here.
Workday has certified to both the Asia-Pacific Economic Cooperation Cross-Border Privacy Rules (APEC CBPR) and Privacy Rules for Processors (APEC PRP). The APEC certifications are a voluntary set of privacy standards developed for data controllers and processors, respectively, to facilitate data transfers among APEC economies. These certifications demonstrate compliance with high standards of privacy compliance throughout the Asia-Pacific region.
Workday was one of the first companies to be certified to the APEC CBPR in March 2014, and the first to be certified for APEC PRP in September 2018. We have received a third-party attestation from TrustArc, which is the APEC Accountability Agent for the United States.
By maintaining compliance with the APEC CBPR and PRP, as well as complying with privacy requirements in the European Economic Area, Workday is able to demonstrate adherence to robust global privacy frameworks.
Today’s technology leaders are charged with securing and protecting the customer, employee, and intellectual property data of their companies in an environment of increasingly complex security threats. Companies are also responsible for complying with all applicable laws, including those related to data privacy and transmission of personal data, even when a service provider holds and processes a company’s data on its behalf.
Workday maintains a formal and comprehensive security program designed to ensure the security and integrity of customer data, protect against security threats or data breaches, and prevent unauthorized access to our customers’ data. The specifics of our security program are detailed in our third-party security audits and international certifications.
To help your compliance and legal teams understand and validate the compliance requirements for your organization, we’ve gathered the following compliance resources.
Service Organization Controls (SOC 1) reports provide information about a service organization’s control environment that may be relevant to the customer's internal controls over financial reporting.
The Workday SOC 2 Type II report is an independent assessment of our control environment performed by a third party.
The American Institute of Certified Public Accountants (AICPA) has developed the Service Organization Control (SOC 3) framework for safeguarding the confidentiality and privacy of information that is stored and processed in the cloud.
ISO 27001 is a globally recognized, standards-based approach to security that outlines requirements for an organization’s Information Security Management System (ISMS).
ISO 27017, published in 2015, is a complementary standard to ISO 27001.
ISO 27018, published in 2014, is a complementary standard to ISO 27001.
Workday supports PCI DSS compliance within the scope of the Workday Secure Credit Card Environment, which is an isolated environment that stores, processes, and transmits unmasked cardholder data through predefined integrations.
Workday has completed a Health Insurance Portability and Accountability Act (HIPAA) third-party attestation for Workday enterprise cloud applications, which provides assurance that Workday has a HIPAA-compliance program with adequate measures for saving, accessing, and sharing individual medical and personal information.
The NIST Cybersecurity Framework (CSF) provides guidance for organizations on how to improve their ability to prevent, detect, and respond to cybersecurity risks. The NIST 800-171 standard relates to protecting Controlled Unclassified Information in non-federal Information Systems and Organizations.
The G-Cloud framework is an agreement between the UK government and cloud-based service providers.
The EU-U.S. Privacy Shield and Swiss-U.S. Privacy Shield are new data transfer frameworks that allow personal data transfers between the EU and the U.S.
TRUSTe’s Certification Standards incorporate principles from privacy frameworks established by APEC, the OECD, and the FTC.
The Cloud Security Alliance (CSA) Security, Trust & Assurance Registry (STAR) Self-Assessment consolidates current information regarding security risks and controls into one industry-standard questionnaire (CSA STAR CAIQ).