Frequently asked questions
Security, compliance and reliability at HarmonyWFM.
Last updated: October 19, 2026
Security
How is our company's data kept separate from other customers?
Every workspace table enforces row-level security in the database itself, so a request can only return rows for the signed-in user's company. Automated tests check that one company can never read another's records.
Who inside our company can see employee information?
Access follows roles and page permissions you control in Profile setup. Managers only see employees covered by their managerial assignments, and permissions are re-checked on the server for every change, not just hidden in the screen.
Is data encrypted?
All traffic uses HTTPS/TLS encryption in transit, and stored data is encrypted at rest by our hosting provider. Signing links for documents are stored only as hashes, and secure-share messages are encrypted and wiped after first opening.
How do sign-ins work?
Accounts are invitation-only. Sessions are short-lived with an idle timeout, repeated failed sign-ins are throttled, and sensitive actions such as approving self-service changes require re-entering a password.
Can HarmonyWFM staff access our workspace?
Support access uses time-limited, audited support sessions. They are recorded in the audit log and do not add anyone to your company roster.
How do I report a security issue?
Contact us through the Security page. We review every report and respond as quickly as possible.
Compliance
Is there an audit trail?
Yes. Approvals, timesheet unlocks, profile and pay changes, and document signing events are audit-logged with who made the change and when. Signed documents include a completion certificate.
Are electronic signatures legally valid?
Document tracking captures signer identity, timestamps, consent and a tamper-evident completed PDF with a certificate of completion, supporting e-signature requirements such as the US ESIGN Act and UETA.
Do you help with labor-law compliance?
Time & Attendance includes break and meal rules, overtime and premium pay rules, compliance violation tracking and holiday calendars. Your company stays responsible for configuring rules that match your jurisdictions.
How long is data kept, and can it be deleted?
Companies can set data retention rules, and purges are logged. You can request export or deletion of your company's data when your agreement ends.
Does HarmonyWFM process payroll?
No. Payroll processing is not currently offered. HarmonyWFM prepares approved hours and pay data for your payroll provider.
Reliability
Where is the platform hosted?
HarmonyWFM runs on managed cloud infrastructure with a globally distributed application layer and a managed Postgres database.
Is our data backed up?
The database is backed up automatically by our managed hosting provider, so data can be restored in the event of an incident.
What happens if something goes wrong?
Application errors and scheduled jobs are monitored, and background work such as reminders and escalation digests is logged and retried so it isn't silently lost.
Can employees clock in if their connection drops?
Mobile workflows that support offline use queue actions and sync them when the connection returns.
Still have questions?
See our Security page or book a demo and we'll walk you through it.