Trust and Security

UKG credentials

• Passwords, client secrets and AuthN organization values are encrypted with AES-256-GCM before they are stored, with a fresh random nonce each time.
• Each user's encryption key is derived from a master key that is kept outside the database, so a copy of the database alone can't unlock any credential.
• An environment can only be used by the person who added it. Secrets are never shown again after they are saved, not even to administrators.
• Tools connect to UKG only over HTTPS, and refuse private, loopback and internal network addresses.

Client data

• Uploaded files and data fetched from UKG are processed in memory. We don't keep the files or the data we fetch, only the results a tool shows you or hands you to download.
• Every tool runs in the background and waits in our database until one of our servers picks it up. Its request, any uploaded file and its results are encrypted with AES-256-GCM using a key unique to you before they are stored, and the upload is deleted as soon as the tool reads it.
• Assignment Analysis anonymizes employee records as they arrive: it keeps only assignments, under a code that is random for each pull, and never names, person numbers, supervisors or contact details. The key behind the codes is destroyed when the pull finishes.
• The most any tool keeps about a real employee is their person number. No tool keeps a real employee's name, contact details, pay or manager; the only names kept belong to made up test employees. The exceptions are the changed copy of your own file that a file utility hands back, API Probe, which only our administrators can use, and Pay Policy Analysis's usage check, which also keeps the shifts people worked on work rule transfers (up to 200 for each work rule), each with the person number, date, punch in and punch out times, total hours and the hours (or money amount) of each pay code it paid.
• Results, on screen or downloadable, and uploads waiting for you to confirm a load, are encrypted with AES-256-GCM in our database, kept for up to 24 hours, then discarded. Database backups leave them out.
• PGP keys and passphrases given to PGP Encrypt / Decrypt are used for that run only and never stored: they are deleted with the request as soon as the run reads them.
• Uploads are size-limited, and zip files and Excel workbooks are checked against how much they unpack to (at most 500 MB for a workbook, 1 GB for other zip files) before anything opens them. A run that goes on for more than 4 hours is stopped.

The Privacy Policy lists every item of personal data we keep and why.

Accounts and access

• Accounts are by invitation only, and each belongs to one customer organization.
• Passwords must be at least 10 characters with upper case, lower case and a digit.
• An account locks for 10 minutes after 5 failed sign-in attempts, and sign-in pages accept at most 10 submissions per minute from one address.
• Two-factor authentication with an authenticator app is required for every user. Authenticator keys are encrypted and recovery codes are stored only as one-way hashes.
• The keys that sign sign-in cookies, password reset links and invitations are stored encrypted with the master key, so a copy of the database can't be used to sign in as anyone.
• Sessions end after 15 minutes without activity.
• The PWCS Excel add-in signs in through this site's own sign-in page, two-factor included, and stays signed in for up to 90 days after its last check. Its sign-in tokens are stored only as one-way hashes and change on every use; disabling an account, changing its password or deactivating its organization signs the add-in out. The Willow Workbench add-in for Excel signs in the same way, and runs only the tools your plan includes, on your own UKG environments.
• Roles separate platform administrators, customer administrators and users. Tools are available only within your organization's plan and licenses.
• Every tool, with its pages, scripts and results, needs a signed-in account with two-factor authentication. Signed out, only the sign-in pages, these policies, the site's shared look and the Excel add-ins' installer and sign-in are available.

Network and application

• The site is served only over HTTPS, with HTTP Strict Transport Security.
• All traffic passes through Cloudflare, which filters attacks before they reach us. The application has no ports open to the internet.
• Pages send security headers that block framing and content sniffing, and every form is protected against cross-site request forgery: a post without the page's own token is refused.
• Pages load no advertising or analytics scripts.

Payments

Subscriptions are paid in Stripe's payment form, which our checkout page loads straight from Stripe, so card details go to Stripe without passing through our servers. The checkout page lets only our own scripts and Stripe's run. Stripe is certified to PCI DSS Level 1, and card details, billing addresses and tax IDs are held by Stripe, never by us. We keep only your organization's Stripe IDs, plan, number of licenses and renewal date.

Hosting

The application and its database run in the United States on infrastructure operated by Purple Willow Consulting, reached only through Cloudflare. The database and its backups are encrypted at rest. Email is sent through Microsoft 365. The Privacy Policy lists every service provider that handles data.

Activity records

Every tool run is recorded with who ran it, when, on which environment and whether it succeeded, without any file contents or UKG data, and every sign-in with who signed in and when. Customer administrators can review their organization's runs on the Runs page.

Security policies

Our security program is set out in ten written policies, approved in October 2026 and reviewed at least once a year. Customers can have a copy for their security review, and prospective customers can too once they've agreed to keep it confidential: email [email protected].

• Information security
• Access control
• Secure development and change
• Cryptography and key management
• Data protection and privacy
• Incident response
• Business continuity and backup
• Vendor management
• Acceptable use and endpoint
• Logging and monitoring

Compliance