The Moveworks Approach: AI you can trust

We understand how critical trust in AI adoption needs to be for your business, so we have made it a priority to create solutions that are as secure, private, and compliant as they are reliable. Our comprehensive approach to Large Language Models (LLMs) enablement and integrations ensures your data is protected while delivering powerful AI solutions that enhance and accelerate your operations. Read more.

Enterprise-grade security and privacy

We implement rigorous measures across the product lifecycle to ensure your data is secure, including:

• Application security and privacy reviews: Assessing and improving the protection of applications and user data.

• Vulnerability scanning: Identifying security weaknesses in software, applications, and other relevant systems.

• External penetration testing: Simulating cyber attacks to test the defenses of internal and external networks.

• Red team exercises: Conducting advanced, realistic cyber-attack simulations to evaluate and enhance overall information security of both enterprise and AI systems.

• Bug bounty program: Incentivizing the discovery and reporting of software vulnerabilities by external individuals.

   

Moveworks leverages AWS as a cloud hosting provider, so your data remains in its region and is never transferred elsewhere. Moveworks is hosted in the following AWS regions:

• US Commercial

• EU Commercial

• US GovCloud

• Canada

• Australia

We always respect the privacy of your data and have implemented processes to handle the minimum amount of data necessary to perform our core functions for your systems that we support. We are committed to safeguarding your data through comprehensive protection measures with a focus on:

• Encryption — Data is encrypted both at rest and in transit to ensure its security.

• Access controls — Strict mechanisms are employed to ensure that all user data is processed and stored securely.

• Compliance — Adherence to relevant data protection regulations along with additional policies and practices to ensure that we only collect the data necessary for our systems to function properly.

• Data minimization — We only collect what we absolutely need to make our service work for you, letting you choose which data sources to connect with us.

• Data masking — We protect your privacy by masking sensitive PII.

   

AI security and privacy by design

Moveworks applies stringent security and privacy standards to protect LLMs, including safeguards against risks such as hallucinations, disinformation, harmful content creation, data poisoning, prompt injection, and more. In so doing, we employ the following trusted approaches, tools, and practices: 

• No customer data is used to train global generative models.

• A content moderation system to filter harmful or inappropriate content, ensuring safe interactions.

• Fact verification to optimize the accuracy of information generated. 

• Prompt protection to safeguard against prompt injection attacks, enabling GenAI tools to respond accurately and securely to user inputs. This protection also helps maintain the integrity of interactions and prevents unauthorized data manipulation.

• Query risk assessment to identify and mitigate potential risks associated with user queries.

• A grounded knowledge system that allows us to ground our solutions with the most up-to-date and trustworthy documentation available. 

• Identity validation that relies on deterministic systems and source-of-truth methodologies for authentication and authorization, ensuring secure access to systems and data without the use of LLMs.

Learn more about how we secure Moveworks solutions in this blog post.

Reporting Vulnerabilities

We value the security of our products and services, and we appreciate your help in keeping them safe. If you find a vulnerability in our products or services, please report it to us through our bug bounty program website.

Moveworks’ bug bounty program is open to all researchers, regardless of their experience level. We offer rewards for vulnerabilities of all severity levels, and we will work with you to ensure that your report is investigated and addressed as quickly as possible.

For additional technical information about security and privacy at Moveworks, get a personalized demo or reach out to your Account Executive or Customer Success Manager to get access to our Whistic profile where you can find further details and certification reports.