Technical & Organizational Measures (TOMs)

Security at every level

Information security at awork isn't a one-time project for us - it's part of what we do every single day.

We protect your customer data through a combination of technical, organizational, and procedural measures that meet the requirements of ISO 27001.

All measures are regularly reviewed, documented, and continuously improved as part of our Information Security Management System (ISMS).

Technical Measures

Area	Measures
Access Control	Data centers are operated by Microsoft Azure in Germany (Frankfurt & Berlin) and meet ISO 27001, SOC 2, and BSI C5 standards. Physical access is strictly regulated.
Authentication	System access is exclusively through individual accounts with two-factor authentication. Access rights are role-based and regularly reviewed.
Authorization / Permission Management	Team members only get access to the systems and data they need for their work (need-to-know principle). All changes are logged and approved.
Encryption	All data is encrypted both at rest and in transit (AES-256 / TLS 1.2+). Customer data in awork is logically separated from each other.
Backup & Recovery	Automated daily backups in separate Azure storage areas; regular restore tests; defined recovery time objectives.
Network Security	Segmentation through firewalls and access restrictions; continuous monitoring for unauthorized activities.
System Hardening & Patch Management	Regular updates, automated security scans, vulnerability management through centralized tools.
Incident Response & Monitoring	24/7 monitoring of critical systems; defined incident response process with escalation procedures and documentation of all incidents.

Organizational Measures

Area	Measures
Information Security Management (ISMS)	Implementation and documentation of all security policies in accordance with ISO 27001; regular internal audits.
Data Protection Management	External Data Protection Officer (PROLIANCE GmbH) guides processes; annual reviews and Data Protection Impact Assessments as needed.
Awareness & Training	All team members complete mandatory security training and phishing simulations; new hires get onboarding plus awareness training.
Access & Role Management	Linked to HR processes (onboarding/offboarding). Access is immediately revoked upon exit and reviewed every six months.
Supplier & Sub-processor Control	All partners evaluated through Privacy & Security checks before engagement; annual recertification.
Business Continuity & Disaster Recovery	Emergency plans for system outages; regular testing and lessons learned sessions.
Continuous Improvement	Security incidents, findings, and customer feedback flow into our ISMS; measures are tracked centrally.

Certifications & Frameworks

ISO 27001 - awork and the data center where we host the app are certified to ISO 27001:2022
BSI C5 / SOC 2 (Azure) - covered by Microsoft
GDPR Compliance - continuously verified by our external Data Protection Officer

In a nutshell

Security is just as important to us as great usability or clean processes.

We handle all the complex stuff behind the scenes so you can focus on your team and your projects.

Reliable, pragmatic, and committed to getting a little bit better every day.

Sub-Processors & Data FlowsPrevious awork and AINext

Last updated July 8, 2026

RSS For developers