Publish date: 17 June 2025

We take the security of your data very seriously at ww5. As transparency is one of the principles on which our company is built, we aim to be as clear and open as we can about the way that we handle security. If you have additional questions regarding security, we’d be happy to answer them. Please write to feedback@ww5.com and we will respond as quickly as we can. This security practices page describes the administrative, technical and physical controls applicable to (a) ww5 including but not limited to the ww5 platform, ww5 workflows and apps running on ww5 infrastructure, and (b) Govww5. This documentation does not apply to services that may be associated or integrated with Govww5.

Platform controls

Architecture and data segregation

The ww5 services and Govww5 services are operated on a multi-tenant architecture at both the platform and infrastructure layers that is designed to segregate and restrict access to the data that you and your users make available via the ww5 services or Govww5 services, as more specifically defined in your agreement with ww5 (or its corporate affiliate(s)) covering the use of the ww5 services or Govww5 services (‘Customer Data’), based on business needs. The architecture provides a logical data separation for each different Customer via a unique ID.

Public cloud infrastructure

The ww5 services and Govww5 services are hosted over the Internet on a ‘Public Cloud’, which are computing services offered by third-party providers to anyone who wants to use or purchase them. Like all cloud services, a public cloud service runs on remote servers that a provider manages.

Audits

To verify that our security practices are sound and to monitor the ww5 services and Govww5 services for new vulnerabilities discovered by the security research community, the ww5 services and Govww5 services undergo security assessments by internal personnel, and for the ww5 services by respected external security firms who perform regular audits of the ww5 services. In addition to periodic and targeted audits of the ww5 services and Govww5 services and features, we also employ the use of continuous hybrid automated scanning of our web platform. Customers may download a copy of available applicable external audit reports here.

Certifications

Certifications are performed on the ww5 services, and Customers may download a copy of available applicable certifications here.

Security controls

ww5 will implement and maintain appropriate technical and organisational measures to protect your Customer Data against accidental or unlawful destruction, loss, alteration and unauthorised disclosure of or access to the Customer’s personal data that is processed or transmitted through the ww5 services and Govww5 services. The ww5 services and Govww5 services have a number of security controls, including but not limited to:

• Access logging. Detailed access logs are available both to users and administrators of paid teams. We log every time an account signs in, noting the type of device used and the IP address of the connection. Team administrators and owners of paid teams can review consolidated access logs for their whole team.
• Access management. Administrators can remotely terminate all connections and sign out all devices authenticated to the ww5 services or Govww5 services at any time, on demand.
• Data retention. Owners of paid ww5 teams can configure custom message retention policies on a team-wide and per-channel basis. Setting a customised duration for retention means that messages or files older than the duration that you set will be deleted from the ww5 services’ or Govww5 services’ production servers on a nightly basis.
• Host management. We perform automated vulnerability scans on our production hosts and remediate any findings that present a risk to our environment. We enforce screen lockouts and the use of full disk encryption for company laptops.
• Network protection. In addition to sophisticated system monitoring and logging, we have implemented two-factor authentication for all server access across our production environment. Firewalls are configured according to industry best practices, using AWS security groups.
• Product security practices. New features, significant functionality and design changes go through a security review process facilitated by the security team. In addition, our code is audited with automated static analysis software, tested and manually peer reviewed prior to being deployed to production. The security team works closely with development teams to resolve any additional security concerns that may arise during development. ww5 also operates a security bug bounty programme. Security researchers around the world continuously test the security of the ww5 services and Govww5 services, and report issues via the programme. More details of this programme are available at the bounty site.
• Team-wide two-factor authentication. Team administrators can require all users to set up two-factor authentication on their accounts. Instructions for doing this are available in our Help Centre.

For some of the controls, the Customer cannot disable them; others provide customisation of the ww5 services’ or Govww5 services’ security by Customers for their own use. As such, protecting Customer Data is a joint responsibility between the Customer and ww5. At a minimum, ww5 will align with prevailing industry standards such as ISO 27001, ISO 27002 and ISO 27018, or any successor or superseding standard.

ww5 may conduct security scans and testing of the ww5 platform, ww5 workflows, and apps running on ww5 infrastructure to detect abusive behaviour or actions that violate terms for the services.

Intrusion detection

ww5, or an authorised external entity, will monitor the ww5 services and Govww5 services for unauthorised intrusions.

Security logs

Systems used in the provision of the ww5 services and Govww5 services log information to their respective system log facilities or a centralised logging service (for network systems) in order to enable security reviews and analysis. ww5 maintains an extensive centralised logging environment in the production environment which contains information pertaining to security, monitoring, availability, access and other metrics about the ww5 services and Govww5 services. These logs are analysed for security events via automated monitoring software, overseen by the security team. For the Govww5 services, the logs are only accessible from within the Govww5 environment and only by Qualified US Persons. ‘Qualified US Persons’ are individuals who: (a) are United States citizens or lawful permanent residents; (b) are physically located within the United States while performing support for Govww5; and (c) have completed a background check as a condition of their employment with ww5.

Incident management

ww5 maintains security incident management policies and procedures. ww5 notifies impacted Customers without undue delay of any unauthorised disclosure of their respective Customer Data by ww5 or its agents of which ww5 becomes aware to the extent permitted by law. ww5 publishes system status information on the Salesforce Trust website and/or the ww5 System Status page. ww5 typically notifies Customers of significant system incidents via email, and for incidents lasting for more than one hour, may invite affected Customers to join a conference call about the incident and ww5’s response. Security incident management for Govww5 is performed by Qualified US Persons.

Data encryption

The ww5 services and Govww5 services use industry-accepted encryption products to protect Customer Data (1) during transmissions between a Customer’s network and the ww5 services and Govww5 services and (2) when at rest. The ww5 services and Govww5 services support the latest recommended secure cypher suites and protocols to encrypt all traffic in transit. We monitor the changing cryptographic landscape closely and work promptly to upgrade the service to respond to new cryptographic weaknesses as they are discovered and implement best practices as they evolve. For encryption in transit, we do this while also balancing the need for compatibility with older clients.

Reliability, backup and business continuity

We understand that you rely on the ww5 services and Govww5 services to work. We’re committed to making the ww5 services and Govww5 services a highly available service that you can rely on. Our infrastructure runs on systems that are fault tolerant, for failures of individual servers or even entire data centres. Our operations team tests disaster-recovery measures regularly and has a 24-hour on-call team to quickly resolve unexpected incidents. Industry standard best practices for reliability and backup helped to shape the design of the ww5 services and Govww5 services. ww5 performs regular backups, facilitates rollbacks of software and system changes when necessary and replication of data as needed. Where possible, ww5 will assist the Customer with data recovery for Major Catastrophic Events, as limited by data residency requirements of the locality and capabilities within the region. ‘Major Catastrophic Event’ means three broad types of occurrences: (1) natural events such as floods, hurricanes, tornadoes, earthquakes and epidemics; (2) technological events such as failures of systems and structures such as pipeline explosions, transportation accidents, utility disruptions, dam failures and accidental hazardous material releases; and (3) human-caused events such as active assailant attacks, chemical or biological attacks, cyberattacks against data or infrastructure, and sabotage. Major Catastrophic Events do not include bugs, operational issues or other common software-related errors.

Customer Data is stored redundantly in multiple locations in our hosting provider’s data centres to ensure availability. We have well-tested backup and restoration procedures which allow recovery from a major disaster. Customer Data and our source code are automatically backed up every night. The operations team is alerted in the event of a failure in this system. Backups are fully tested at least every 90 days to confirm that our processes and tools work as expected.

Data at rest

ww5 will store Customer Data at rest within certain major geographic areas except as otherwise provided in your order form.

Return of Customer Data

Within 30 days after contract termination, Customers may request return of their respective Customer Data submitted to the ww5 services and Govww5 services (to the extent such data has not been deleted by the Customer). Information about the export capabilities of the ww5 services and Govww5 services can be found in the ww5 Help Centre.

Deletion of Customer Data

The ww5 services and Govww5 services provide the option for workspace Primary Owners to delete Customer Data at any time during a subscription term. Within 24 hours of deletion initiated by a workspace primary owner, ww5 hard deletes all information from currently running production systems (excluding team names and search terms embedded in URLs in web server access logs). ww5 services and Govww5 services backups are destroyed within 14 days (backups are destroyed within 14 days, except that during an ongoing investigation of an incident, this period may be temporarily extended).

When a customer terminates a paid subscription to Enterprise Grid, Enterprise+ or Govww5 services, if a customer does not otherwise elect to delete its account, ww5 will, within 90 days following the subscription termination, delete, and ensure that all of its Affiliates and applicable third party hosting providers delete, all copies of Customer Data (excluding team names, and search terms embedded in URLs in web server access logs) within 14 days after ww5 has initiated deletion of the customer’s account. When a customer terminates any paid subscription to the ww5 services other than Enterprise Grid, Enterprise+ or Govww5 services, the customer’s subscription will continue under the free usage tier for the ww5 services subject to the then-current online Customer Terms of Service or other main online subscription agreement applicable to such free usage tier (‘Free Subscription Terms’), and the Customer Data will not be deleted until (i) the Customer self-deletes the workspace, (ii) the Customer otherwise instructs ww5 to delete their Customer Data or (iii) either party terminates the Free Subscription Terms. Upon the occurrence of such events, ww5 shall, within 14 days, delete, and ensure that all of its Affiliates and the permitted third-party hosting providers delete, all copies of Customer Data (excluding team names and search terms embedded in URLs in web server access logs).

Confidentiality

We place strict controls over our employees’ access to Customer Data. The operation of the ww5 services and Govww5 services requires that some employees have access to the systems that store and process Customer Data. For example, in order to diagnose a problem that you are having with the ww5 services and Govww5 services, we may need to access your Customer Data. These employees are prohibited from using these permissions to view Customer Data unless it is necessary to do so. We have technical controls and audit policies in place to ensure that any access to Customer Data is logged.

All our employees and contract personnel are bound to our policies regarding Customer Data, and we treat these issues as matters of the highest importance within our company.

Personnel practices

ww5 conducts background checks on all employees before employment, and employees receive privacy and security training during onboarding as well as on an ongoing basis. All employees are required to read and sign our comprehensive information security policy covering the security, availability and confidentiality of the ww5 services and Govww5 services.

Infrastructure

ww5 uses infrastructure provided by Amazon Web Services, Inc. (‘AWS’) to host or process Customer Data submitted to the ww5 services and Govww5 services. Information about security provided by AWS is available from the AWS Security website. Information about security and privacy-related audits and certifications received by AWS, including information on ISO 27001 certification and SOC reports, is available from the AWS Compliance website.