Security

HarmonyWFM is multi-tenant by design. Every workspace table enforces row-level security in Postgres, so a query can only return rows belonging to the requesting user's company. Isolation is enforced in the database itself, not only in application code, and privileged server operations verify the caller's company and role before running.

Roles are stored separately from user profiles and checked server-side. Employees see only their own records, managers see the reporting chains assigned to them, company administrators see their company, and platform administrators are a separate, explicitly granted role. Administrative access to a customer workspace is logged.

Traffic to the application and to the database is encrypted in transit with TLS. Stored data and file uploads sit on managed infrastructure with encryption at rest provided by the hosting platform.

Sign-in uses managed authentication with hashed credentials, email-based invitation and password reset flows, and short-lived session tokens. Anonymous sign-up is disabled; accounts are created by invitation from an administrator.

The platform records an audit trail of sensitive actions — timecard edits and approvals, role and profile changes, impersonation sessions, and lifecycle events. Application errors and background job runs are monitored through internal health dashboards.

HarmonyWFM is operated by HarmonyWFM. Customer workspace data — records, documents, and uploads — is stored on managed Postgres and object storage in Canada (AWS ca-central-1). The application and API are served over a global edge network; supporting providers for email, AI features, and video are named on the Subprocessors page.

Customer data is stored on managed Postgres infrastructure with automated backups handled by the hosting provider. Customers can export their own data at any time from within the product.

HarmonyWFM is not currently SOC 2 or ISO 27001 certified. We describe our controls honestly rather than implying audits we have not completed, and we are happy to complete a security questionnaire for procurement review.

If you believe you have found a security issue, email admin@harmonywfm.com with steps to reproduce. Please avoid accessing data that is not yours, avoid degrading the service, and give us a reasonable window to respond before public disclosure. We acknowledge reports and keep reporters updated through remediation.