WhosOnLocation Security

Customer data is one of the most valuable assets your company has which is why our top priority is delivering a high-performance solution with a focus on keeping our customers’ data safe and their interactions secure.

WhosOnLocation understands that the confidentiality, integrity, and availability of our customers’ information are vital to their business operations and our own success. We use a multi-layered approach to protect that key information, constantly monitoring and improving our application, systems, and processes to meet the growing demands and challenges of security.

Data Protection & Security

WhosOnLocation is committed to helping protect the security of customer’s information. We have implemented, maintained and followed appropriate technical and organizational measures to protect our customer’s data against accidental, unauthorized or unlawful access. Ensuring your customer data is not disclosed, altered, lost, or deleted.

ISO, Compliance & Certifications

We at WhosOnLocation know that it takes a lot of trust to put your data in the Cloud. As a customer, you need to know that the partners you share this information with have the secure treatment of such information as their top priority.

We also understand that we have customers in many different regions, who in turn deal with many different standards and frameworks for the proper treatment of sensitive information. With this in mind, we put in place the practices and procedures of the globally respected industry benchmark standards put forth by the International Organization for Standardization in the form of ISO 27001.

Access to our ISO Documentation

Our ISO27001:2013 Certificate

Our certificate is available for download

Our ISO27001:2013 Policy Documents

As part of your evaluation of WhosOnLocation and to assist you with your audit of our standard operating procedures and controls, you can request copies of the following shareable policies by selecting the Request Documents button below and completing our request form:

• Information Security Policy
• Statement of Applicability
• Business Continuity Plan

Upon completing the form you will be directed to our NDA which must be agreed to. Upon receipt of your agreement to our NDA we will evaluate your request and if approved, confirmation will appear in your email inbox. Please allow up to 5 business days for your request to be processed.

Please note: WhosOnLocation reserves the right to ‘not share’ with you our ISO policy documentation should we determine that it is not appropriate to do so. We will inform you of that decision if applicable.

General Data Protection Regulation GDPR

WhosOnLocation has a rigorous process to ensure our software provides features that enable our customers (Data Controllers) to be GDPR compliant. These features include:

• The right of access
• The right to erasure
• The right to object
• The right to rectification
• The right to restrict processing
• The right to data portability
• The right not to be subject to automated decision-making including profiling.

How does WhosOnLocation support your GDPR compliance efforts?

• Your visitors data is kept private and is not shared with third parties.
• Your visitors have an option to be chosen ‘not to be remembered’.
• We give our customers tools for automatically deleting (or anonymizing) visitor data after a certain length of time.
• Visitor records can be rectified by your administrators on request by a visitor.
• Our customers can remove one, some, or all visitor records should they request that their details be removed from WhosOnLocation.
• You can create custom forms like ‘a consent and permission form’, an NDA, a Waiver, and/or a Privacy Policy (optionally with signature required) to ensure your visitor is aware of your policies, procedures, and use of their personal information.

International Traffic in Arms Regulations ITAR

International Traffic in Arms Regulations (ITAR) control the export and import of defense-related articles and services on the United States Munitions List (USML). According to the U.S. Government, all manufacturers, exporters, and brokers of defense articles, defense services, or related technical data must be ITAR compliant. Therefore, more companies are requiring their supply chain members to be ITAR compliant as well.

WhosOnLocation complies with ITAR through the following:

• Maintaining an information security policy
• Building and maintaining a secure network by installing and maintaining firewall configuration to protect data and avoiding the use of vendor supplied passwords and other security details
• Assigning a unique ID to each person with computer access
• Regular test security systems and processes
• Protect sensitive data with encryption
• Regular monitor and test networks
• Implement strong access control measures
• Track and monitor all access to network resources and sensitive data
• Maintain a vulnerability management program
• Implement measures to prevent the loss of ITAR controlled data

Customs-Trade Partnership Against Tourism C-TPAT

The Customs-Trade Partnership Against Terrorism (C-TPAT) is a voluntary supply-chain security program led by U.S. Customs and Border Protection (CBP) focused on improving the security of private companies' supply chains with respect to terrorism.

WhosOnLocation support the C-TPAT criteria through:

• Physical access control management for guest, contractors, employees and deliveries
• Information Technology Security | Password Protection

For detailed information on WhosOnLocations compliance with C-TPAT click here.

Good Manufacturing Practice GMP

Good Manufacturing Practices (GMP) is a system for ensuring that products are manufactured, packaged, and controlled according to industry quality standard. To put it simply GMP helps ensure a quality product.

WhosOnLocations helps organizations manage their compliance to meet GMP obligation including attendance tracking, hazard notice compliance, and induction management. For more info on GMP and WhosOnLocation click here.

FDA Food Safety Modernization Act FSMA

The Food Safety Modernization Act (FSMA) was enacted in 2011 to ensure food safety in the United States. FSMA aims to shift the focus toward preventing intentional adulteration of the food supply rather than responding to contamination. As such, requirements cover the mitigation of threats that make food production facilities vulnerable.

WhosOnLocaiton ensures that unauthorized visitors gain access to your facility. Ensuring everyone who enters the facility is authorized and accounted for.

• Verify visitor identity (photo capture, ID check, pre-registration) and deny access to those who are not permitted
• Maintain detailed real time reporting of entry, exist and sites accessed while onsite
• Require a valid purpose of visit and escort (host) upon sign-in
• Visitors sign any documentation needed to ensure they agree to onsite regulations and or NDA’s
• Contractors undertake inductions to comply with the site requirements and hold relevant and up to date insurances
• All visitor and contractor display badges
• Use zones within your organization to restrict access and accurately track access

TRUSTe Enterprise Privacy Certification

WhosOnlocation has demonstrated that our privacy programs, policies, and practises meet the requirements of EU-U.S Privacy Shield and/or Swiss-U.S. Privacy Shield. These companies have self-certified their participation in Privacy Shield with the U.S Department of Commerce at https://www.privacyshield.gov/list. TRUSTe verifies Privacy Shield compliance consistent with the requirements of the Privacy Shield Supplemental Principle on Verification.

California Consumer Privacy Act CCPA

About WhosOnLocation and the California Consumer Privacy Act

"The CCPA came into force on 1 January 2020 (called the “compliance date”), the Californian Attorney General won’t start enforcing it until 1 July 2020 (“enforcement date”). One of the key elements of the CCPA, amongst others, is that it focuses on transparency obligations and on provisions that limit the selling of personal information, requiring a “Do Not Sell My Personal Information” link to be included by businesses on their homepage.

Does CCPA apply to WhosOnLocation?

WhosOnLocation does not “sell” customer’s personal information, meaning that we also do not rent, disclose, release, transfer, make available or otherwise communicate that personal information to a third party for monetary or other valuable consideration.

WhosOnLocation also adheres to the highest standards for the capture, processing, and management of personally identifiable information and this includes NEVER sharing ANY information we capture from our customers or their 'data subjects'; employees, contractors and/or visitors. To read our full privacy policy, click here.

Because WhosOnLocation does not fall within any of the thresholds specified under the CCPA that determines whether or not we would be required to comply, the CCPA does not apply to WhosOnLocation today, however; we wanted to assure you that WhosOnLocation does take data privacy extremely seriously.

Our privacy commitment

We have designed our systems and adopted standard operating procedures to ensure we are compliant with the General Data Protection Regulations (GDPR). GDPR came into effect on 25 May 2018 and is one of the most comprehensive data protection laws in the world to date. We also undertake external auditing against our information security management systems and are ISO27001: 2013 certified. To review our full security statement, click here.

Ongoing monitoring

We will continue to review and monitor our adherence to CCPA and should our circumstances change we will take the necessary steps to adhere.

WhosOnLocation Employee Security

Security awareness

Policies - WhosOnLocation has a comprehensive set of security policies covering a range of topics. These policies are shared with and made available to all employees and contractors with access to WhosOnLocaiton information assets.

Training - All WhosOnLocation employees attend Security Awareness Training which is given within 14 days of hire and then on an annual basis. All developers undergo annual Secure Development Training on best practices and OWASP awareness.

Employee vetting

Background checks - WhosOnLocation performs background checks on all new employees in accordance with local laws. All contractors are required to complete a clean slate agreement and comply with our confidentiality agreements.

Confidentiality agreements - All employees and contractors are required to sign non-disclosure and confidentiality agreements.