Workhuman Security and Privacy Baseline

Overview

Map customer and Workhuman responsibilities and enforce least privilege, data minimization, financial integrity, and evidence-based incident controls.

Prerequisites

• Tenant products, integrations, data flows, environments, owners, and current agreements
• Workforce-data classification, retention, residency, legal, and incident requirements
• Identity, HCM, payroll, recognition, security, privacy, and vendor contacts

Tool Discipline

Use Read, Glob, and Grep to inspect configurations and flows, WebFetch to verify current first-party commitments, and Write or Edit for threat models, control matrices, and redacted evidence.

Current Contract

Workhuman publicly states support for SSO, fraud detection, granular user privileges and grouping, encryption and monitoring practices, GDPR and CCPA compliance, ISO 27001:2022 and ISO 27701:2019 certification, and defined PCI scope. Confirm scope and customer obligations in current agreements rather than treating marketing statements as the entire control contract.