Security in Datwise is built in layers: infrastructure, encryption, identity, permissions, security testing and organisational processes. Run it in our managed cloud or on your own servers.
Privacy Protection LawIncluding the registration or notification duties for the databases we are responsible for.
GDPRWhere relevant to the engagement.
Information security and privacy overview, August 2026
Two ways to deploy
With a clear split of who is responsible for what.
Managed cloudHosted on AWS, in the Israel region. Datwise manages the hosting environment, perimeter protection, backups and monitoring, under its information security policy.
Datwise: hosting, protection, backups, monitoring
On-premisesInstalled on the organisation's own servers. Datwise is responsible for the application and its built-in controls.
Datwise: the application and its controls
You: infrastructure, network, operating systems, backups and physical security
Key controls
CISO and DPOA dedicated chief information security officer and data protection officer are responsible for security and privacy.
SOC monitoringA security operations center uses a SIEM to monitor our traffic and assets, including the Datwise system.
Data in transitIn the cloud, data travels over HTTPS with TLS 1.2 or higher. On-premises, encryption follows your own certificates and settings.
Data at restPersonal details defined as sensitive are encrypted at the application level with AES-256.
MFA and SSOMulti-factor sign-in with a one-time code by email or SMS, or an authenticator app. On request, SSO with Azure, Google, Active Directory, Microsoft Entra ID and Okta.
Role-based permissionsView, add, update and delete rights for every module, limited by company, contractor, project, department, country, region and site. Separate rights for sensitive HR data such as ID numbers and medical checks.
Protection from automated activityCAPTCHA in the relevant interfaces.
Activity logUser actions are recorded for control, tracking and investigation.
Penetration testingTested by external security companies, including penetration tests once every 18 months.
Backups and continuityBackup, recovery and business continuity processes, with ongoing backups in the cloud.
Incident responseAn orderly process to identify, report, investigate, handle and learn from security incidents.
Sub-processorsRelevant sub-processors are reviewed and controlled, and kept on an up-to-date list.
Need the details for your IT team?
We will send you the full information security and privacy overview.