Security & compliance
Governance you can defend
Workkeep is built for enterprises where security review is part of buying software. Here's how we handle your data, control access and keep a defensible audit trail.
01
Data handling
Workkeep processes metadata about your SharePoint estate — site structure, ownership, activity and configuration — not the content of your documents.
Metadata-first architecture
Discovery reads site properties, permissions and activity signals through the Microsoft Graph API. Document contents are never copied or stored by default.
Encryption everywhere
All data is encrypted in transit with TLS 1.2+ and at rest with AES-256. Keys are managed and rotated by our cloud infrastructure provider.
EU data residency
Customer data is hosted in EU regions by default. Alternative residency options are available on Enterprise plans.
Retention & deletion
You control how long estate metadata is retained. When a contract ends, all customer data is deleted within 30 days, with certification on request.
02
Access controls
Least-privilege access to your tenant, and to the Workkeep console itself.
Granular Microsoft 365 consent
Workkeep connects via an Entra ID app registration using read-only Graph scopes. Write actions (archive, reassign) use separate, explicitly consented permissions.
SSO & SCIM
SAML SSO and SCIM provisioning with your identity provider (Entra ID, Okta) on Growth and Enterprise plans.
Role-based access
Console roles — viewer, operator, administrator — map to your team's responsibilities. Multi-factor authentication is enforced for all accounts.
Session security
Short-lived sessions, device binding and anomaly detection on sign-in. API access uses scoped, revocable tokens.
03
Audit trails
Every governance decision leaves a trace you can defend in front of auditors.
Complete action log
Every lifecycle action — archive, owner change, policy edit — is recorded with actor, timestamp, target and justification.
Immutable history
Audit records are append-only and retained per your plan (90 days to 7 years). Exports available in CSV and via API.
Change attribution
Policy changes show who changed what, when, and the before/after state — so configuration drift is always explainable.
04
Enterprise requirements
Built to pass your security review, procurement process and compliance programme.
GDPR & CCPA ready
Data Processing Agreement available on all plans. Workkeep acts as a processor; you remain the controller of your estate data.
Security assessments
We complete standard questionnaires (CAIQ, SIG) and support customer pen-test review under NDA on Enterprise plans.
Uptime & continuity
99.9% availability target with contractual SLA on Enterprise. Status page and incident communications included.
Vendor transparency
A current list of subprocessors is maintained and customers are notified of changes in advance.
Running a security review of Workkeep?
We'll provide our security whitepaper, DPA and completed CAIQ on request.
Request a demo