Security
Find all information about our security processes, server locations and best practises in place.
This page covers all of our apps — Alfy (connections), Billy (celebrations), Clappy (recognition), Linky (directory), Palmy (leave management), Pulsy (surveys), Stany (check-ins) and SimplePerf (performance reviews) — whether used in Slack, Microsoft Teams, Pumble, or through our dashboard at dashboard.buddieshr.com.
Data
Security policies
- Acceptable Use Policy
- Access Control and Termination Policy
- Business Continuity and Disaster Recovery Plan
- Change Management Policy
- Code of Conduct
- Configuration and Asset Management Policy
- Data Classification Policy
- Data Retention and Disposal Policy
- Encryption and Key Management Policy
- Information Security Policy
- Internal Control Policy
- Network Security Policy
- Performance Review Policy
- Physical Security Policy
- Risk Assessment and Treatment Policy
- Secure Development Policy
- Security Incident Response Plan
- Vendor Management Policy
- Vulnerability and Patch Management Policy
Certifications
Sub-processors
We use a small number of trusted sub-processors to operate BuddiesHR. Each provider is vetted for GDPR compliance and bound by equivalent data protection obligations.
| Name | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| AWS | Cloud hosting, database and file storage | EU (Paris, eu-west-3) | DPA |
| Hetzner | Load balancers and application servers | EU (Germany) | DPA |
| MongoDB Atlas | Managed database (hosted on AWS Paris) | EU (Paris) | DPA + SCCs |
| Mailjet | Transactional and notification email | EU (France) | DPA |
| lemlist | Lifecycle email to workspace administrators | EU (France) | DPA |
| Rollbar | Error monitoring | EU (Ireland) / US | SCCs |
| PostHog | Product analytics | EU (Frankfurt) | DPA |
| Crisp | Customer support chat | EU (France) | DPA |
| OpenAI | AI features (see AI section) | US | SCCs |
| Stripe | Payments and subscription management | US / EU | SCCs |
| Slack Technologies | Messaging platform integration | US | SCCs |
| Microsoft | Teams integration, Microsoft sign-in, Outlook Calendar | US / EU | SCCs |
| Google Calendar, Google sign-in | US | SCCs | |
| CAKE.com (Pumble, formerly COING) | Messaging platform integration | US | SCCs |
The following are used only when a customer chooses to connect them: BambooHR and Lattice (US, SCCs), for syncing birthdays and hire dates.
We may update this list as we add or remove sub-processors. Any new providers will be bound by the same data protection obligations as those listed above. Our Data Processing Agreement refers to this table as the current list of sub-processors.
AI features
Some features use AI to make suggestions: improving a review question, analysing a review cycle, coaching follow-up questions in SimplePerf, classifying check-in questions in Stany, mapping columns when you import a spreadsheet, and generating celebration content in Billy.
To provide them we send the relevant content to OpenAI, our AI sub-processor, which processes it in the United States under Standard Contractual Clauses. OpenAI does not use this content to train its models. Under our agreement it may retain it for up to 30 days for abuse monitoring before deletion.
AI output is always a suggestion for a person to accept, edit or reject. We never use AI to make automated decisions about individuals, and no AI output determines anyone’s evaluation, compensation or employment. We keep a record of AI requests and their responses so administrators can rate the quality of the output; those records are deleted with the rest of your workspace data.
Useful links
Any question?
Contact us at security@buddieshr.com
For privacy questions, data requests and complaints: privacy@buddieshr.com