The following processes are in place to protect your data from unwanted third parties:

• Application design: We have designed the system from the ground up with security in mind.  By applying best practices in web application security, we aim to prevent critical vulnerabilities.
• SSL: We encrypt all customer information in transit using modern TLS.
• Strong encryption: Sensitive information (social security numbers, driver license numbers, etc.) is encrypted in our database by using the Advanced Encryption Standard (AES).
• Firewall: Our application, including our customers' data, sits behind appropriate firewalls.
• Vulnerability scanning: We regularly undergo vulnerability scanning and penetration testing and maintain an active bug bounty program.
• New browser login notifications: See details below.

All of your data is backed up nightly in at least two distinct availability zones. Backups are encrypted and transferred over TLS to protect the data in transit and at rest. The purpose of backing data up in this manner is to guard against unforeseen hardware issues (i.e., challenges with a particular server or an unexpected data center outage) and restore a full account with all data due to a similar issue as those mentioned above.  

Our developers may manually retrieve individual employee or field data (i.e., if someone in your company accidentally deletes some information within a specific field) on a case-by-case basis, but it may incur an additional cost.

If you have any concerns about the security of your data stored in BambooHR, please take the following steps: 

1. Collect as much information about your security concern as possible. 
2. Click on the question mark icon in the upper right-hand corner of the BambooHR app and select Submit a Support Request. 
3. In the body of the request, please provide as much information as possible about your security concern, including whatever supporting evidence caused you to become concerned for your data. 
4. The system will send your concern to our Support team initially. Depending on the severity of the issue, Support may send the concern to our Security team, who will then investigate to ensure that your data is secure. We will inform you of our investigative findings, along with any additional recommendations. 

The General Data Protection Regulation (GDPR) (EU) 2016/679 is a regulation in EU law on data protection and privacy for all individuals within the European Union. It addresses the export of personal data outside the EU. The new General Data Protection Regulation (GDPR) went into effect as of May 25, 2018.

You will need to sign a DPA (Data Processing Agreement) if the following applies to you:

• You are a current BambooHR customer.
• You have employees located in one of the current EU countries.

When getting started with your BambooHR account, the first Full Admin user or the Account Owner to log in will see the GDPR Compliance modal. This modal will show several options:

• No, we don't: Selecting this will dismiss the DPA, and a record of the dismissal will appear in Settings > Account > Account Info. If you need to accept the DPA due to a change at your company, you can find a link to review the DPA in the Account Info section.
• Yes, we do: Selecting this will prompt you to review and accept the DPA. A record of your acceptance will appear in Settings > Account > Account Info.
• *Complete Later: Selecting this will dismiss this modal, but a notification will still remain in the What's Happening widget on Home until you have accepted or dismissed the DPA.

When there is a large enough update to the DPA,* the first Full Admin user or Account Owner to log in to BambooHR will receive an announcement alerting you of the update. You will be able to read through the full DPA and agree to it by checking the box and clicking Save. This will dismiss the announcement.

Running a secure operation starts with creating a secure application, but it also requires constant monitoring, improvement, and vigilance against internal and external threats. Want to see the complete report of our ongoing security measures for yourself?

We make it easy to validate the safety of your data with us by bringing together all the security documentation (reports, certificates, audits, and questionnaires) you are looking for in a single location—BambooHR Trust Center, powered by SafeBase. Click here to access our current security profile.

1. Is any data stored on the device?
   1. We store authentication information (no passwords), some user interface settings, and other internal-use information on the device. We also store images and files in temporary, OS-protected folders. In some cases, we store minimal directory information for transfer to the OS (caller id on iOS).
2.  If data is stored on the device, is it encrypted?
   1. Yes, for all authentication, settings, and internal information. We store any unencrypted information in OS-protected folders, which means that it is unavailable outside the app (unless the device is jailbroken/rooted).
3. If the device is lost or stolen, how is data removed?
   1. The user should reset their password. Doing this will NOT remove the app or its data from the device but will make the app unusable.
4. Does the application have any opening security before login (i.e., PIN or biometric to prevent unauthorized access), or if the phone is left open, does the app prevent access with additional security before you can access it again? 
   1. The user can configure the application to use either a PIN or biometric login, depending on what the OS supports. The user is not required to configure either of these.

For more information on subprocessors, click here.