Enterprise-grade security and privacy
Moveworks enforces rigorous measures across the entire product lifecycle to ensure every customer's data is always secure.
- Text 1
How Moveworks earns and maintains trust with every customer
Application security and privacy reviews
Assessing and improving the protection of applications and user data.
Vulnerability scanning
Identifying security weaknesses in software, applications, and other relevant systems.
External penetration testing
Simulating cyber attacks to test the defenses of internal and external networks.
Red team exercises
Conducting advanced, realistic cyber-attack simulations to evaluate and enhance overall information security of both enterprise and AI systems.
Bug bounty program
Incentivizing the discovery and reporting of software vulnerabilities by external individuals.
AWS is Moveworks' cloud hosting provider
All customer data remains in its region and is never transferred elsewhere.
Moveworks is hosted in the following AWS regions:
- US Commercial
- EU Commercial
- US GovCloud
- Canada
- Australia
The privacy of your data is always respected
Moveworks is committed to safeguarding all customer data through the most up-to-date and comprehensive protection measures.
Encryption
Data is encrypted both at rest and in transit to ensure its security.
Access controls
Strict mechanisms are employed to ensure that all user data is processed and stored securely.
Data masking
Customer privacy is always protected by masking sensitive PII data.
Compliance
Adherence to relevant data protection regulations along with additional policies and practices to ensure that we only collect the data necessary for our systems to function properly.
Industry compliance that goes above and beyond
Strict compliance with global, regional, and industry-related privacy laws and security standards is always adhered to and measures are regularly optimized, implemented, and updated to meet additional compliance obligations as needed or requested.
ISO/IEC 27001:2013
Global standard for information security management systems
ISO/IEC 27017:2015
Code of practice for information security controls for cloud services
ISO/IEC 27018:2019
Code of practice for identifying personally identifiable information (PII)
ISO/IEC 27701:2019
Privacy information management standard supporting compliance with global privacy laws
SOC 2 Type 2
Security, confidentiality, availability, and privacy TSC
CSA Star Level 2
Enhanced security controls for cloud service providers
GDPR
Protecting data privacy rights
CCPA
Safeguarding consumer privacy rights
FedRAMP
Providing government-grade trust, security, and privacy
AI security and privacy by design
Moveworks applies stringent security and privacy standards to protect LLMs, including safeguards against risks such as hallucinations, disinformation, harmful content creation, data poisoning, prompt injection, and more.
The following enterprise-grade security approaches, tools, and practices are always employed:
- No customer data is used to train global generative models.
- A content moderation system to filter harmful or inappropriate content, ensuring safe interactions.
- Fact verification to optimize accuracy of information generated.
- Prompt protection to safeguard against prompt injection attacks, enabling GenAI tools to respond accurately and securely to user inputs. This protection also helps maintain the integrity of interactions and prevents unauthorized data manipulation.
- Query risk assessment to identify and mitigate potential risks associated with user queries.
- A grounded knowledge system that allows us to ground our solutions with the most up-to-date and trustworthy documentation available.
- Identity validation that relies on deterministic systems and source-of-truth methodologies for authentication and authorization, ensuring secure access to systems and data without the use of LLMs.
Moveworks’ bug bounty program
We value the security of our products and services — and we appreciate your help in keeping them safe. If you find a vulnerability in our products or services, please report it to us through our bug bounty program website.
Moveworks’ bug bounty program is open to all researchers, regardless of their experience level. We offer rewards for vulnerabilities of all severity levels, and we will work with you to ensure that your report is investigated and addressed as quickly as possible.
