The GPTW analytical survey platform named Emprising is hosted by the cloud provider Microsoft Azure. GPTW contracts with Azure to maintain the highest level of Data Security and Data Privacy global compliance at all times. This legal protection is passed along to all GPTW clients though the warranties in the Products and Services Agreement for the entire term of our engagement as detailed below. The Azure audit reports and other resource documentation as well as the Azure Compliance Manager Tool used by GPTW to comply with the GDPR and other privacy laws are found at the following URLs: https://servicetrust.microsoft.com/ and other compliance offerings: www.microsoft.com/en-us/trustcenter/compliance/complianceofferings. A general article about Azure compliance is here: www.communicationsquare.com/news/everything-about-gdpr-compliance-in-microsoft-cloud/ and a blog here: azure.microsoft.com/en-us/blog/protecting-privacy-in-microsoft-azure-gdpr-azure-policy-updates/ There are some country specific compliance resources as well. For example, compliance in Germany is addressed at the following URL: servicetrust.microsoft.com/ViewPage/GermanComplianceResourcesV3.

To offer an abundance of legal protection to GPTW clients, contractual warranties and representations are provided for the GPTW computer network even though Emprising is hosted by Azure and not the GPTW computer network. Any communication between Emprising hosted on Azure and the GPTW computer network is strictly limited to an end-to-end secure VPN connection using IPSec protocol. GPTW provides the highest standard of legal protection by warranting to our clients that during the entire term of the engagement, GPTW has not received notice of non-compliance  with the following industry standards: CPA-audited financial statements by the firm Abbott, Stringham & Lynch, Service Organization Controls (SOC) Report 2 under the Statement on Standards for Attestation Engagements (SSAE) 18 as well as with the International Organization for Standardization (ISO) 27001:2013 and ISO 9001:2015 and the National Institute of Standards and Technology (NIST 2015) cybersecurity framework. If applicable, GPTW also complies with the Payment Card Industry Data Security Standard (PCI DSS).  These warranties are stated in Section 7 (Data Security) of the GPTW Products and Services Agreement which governs the terms of the engagement with GPTW clients and which has the following link on the bottom of the GPTW homepage:  www.greatplacetowork.com/products-services-agreement. GPTW maintains a full-time Chief Data Protection Officer (CDPO) and staff to ensure compliance with these industry standards.  The CDPO reports directly to the CEO of GPTW.

GPTW considers the third-party financial and security audits of the GPTW computer network to be for “restricted use” and confidential.  Accordingly, GPTW does not release them to any company.  There are several reasons for this policy.  First, a “restricted use” provision is recited in every valid SOC 2 Report.  Second, the audits are static in time and may not cover the entire term of the company’s engagement.  Third, the audits provide no legal protection to a company.  Fourth, a company having possession of these audits places itself at serious risk for no benefit, e.g. should there be a GPTW security breach, any company in possession of these audits would be a primary litigation target and would have to prove that company’s possession of the audits did not cause the GPTW breach.