FAQ

Top 20 - Most Frequently Asked Questions About Data Protection, Security & AI at awork

Data Processing Contracts & Data Protection

1. What role does awork play in processing personal data?
   awork acts as a data processor according to Article 28 of the GDPR.
2. Where is our customer data stored?
   Primarily in Germany (Microsoft Azure Germany).
3. Is data processed or transferred outside the EU?
   In selected cases, yes (for example, support and communication services), exclusively with Standard Contractual Clauses and/or where an adequacy decision exists.
4. Does awork conduct Transfer Impact Assessments (TIAs)?
   Yes, whenever required for transfers to third countries.
5. Which sub-processors does awork use and what for?
   awork uses selected sub-processors to operate the platform and provide supporting support and service functions. You can find the complete, up-to-date list of all sub-processors including their purpose and location here.
6. Can I object to the use of a new sub-processor?
   Yes, for legitimate reasons, as governed in the data processing agreement.
7. Is there a Data Protection Officer?
   Yes, PROLIANCE GmbH (external DPO).
8. Can I delete my data myself?
   Yes, workspace admins can delete the workspace themselves.
9. How long is data retained after deletion?
   Approximately 30 days, unless legal obligations require otherwise.
10. Is awork compliant with GoBD?
    awork supports GoBD-compliant usage; responsibility for correct implementation lies with the customer.

Security & Information Security

1. Is awork ISO 27001 certified?
   Yes, ISO/IEC 27001, including product, operations, and internal processes.
2. Is the Microsoft data center secure?
   Yes, Azure Germany meets ISO 27001, SOC 1/2, and BSI C5, among others.
3. Does Microsoft have access to our data?
   No. The Azure tenant is controlled exclusively by awork.
4. Can awork employees easily view our workspace?
   No. Access only in exceptional cases, strictly limited (least privilege principle).
5. Is there tenant separation?
   Yes, strict logical tenant separation at the application and database level.
6. Is our data encrypted?
   Yes, both in transit (TLS) and at rest.
7. How does awork ensure protection against data loss and the recoverability of customer data?
   awork protects customer data through automated, regular backups with defined restore processes and recovery testing.

Artificial Intelligence (AI)

1. Which AI does awork specifically use?
   Microsoft Azure OpenAI, hosted in Europe (Sweden Central).
2. Is our data used for AI training?
   No. AI models are not trained using customer data.
3. Is AI mandatory in awork?
   No. It's active by default, but admins can disable it at any time.
4. How is awork classified under the EU AI Act?
   Low risk. No high-risk or prohibited AI practices.