Security and data protection

The plan first, then the change

Each difference appears as a change with its old and new value. What you set to review waits for a person; what is set to auto is written and logged. Safety limits hold large syncs, many leavers in one day and many new runs. If someone has changed a field or the OU in Google meanwhile, idenflow does not overwrite it.

Four eyes

Deleting an account always needs approval, and a hand-over to anyone but the manager always needs a second person. With four-eyes on, a run started by hand waits for a second person before its first step and before an account is created, suspended or deleted. Runs from HR data are not held by it, so a leaver's suspension does not stall.

Nobody decides about themselves: whoever started a run or wrote a step, the person it is about and whoever receives something from it cannot approve it. Anyone with run or approve rights can hold a step that has not started for review.

Audit log

Every written change, every approval and every step is in the audit log, with the person or system and the time, and for changes the old and new value.

The audit log is append-only: database triggers stop anyone, the database owner included, from changing or deleting entries. Entries are chained per organisation; an edited, inserted or removed entry shows up in the check, which you run from the app. Every hour, the latest head of each chain is published outside the database. You can export the audit log as CSV.

Access to Google

Google access runs through domain-wide delegation, which a super admin adds in the Google Admin console. For our hosted service it is built to run without a key file: Google Cloud's IAM Credentials API signs the delegation token, and no downloadable key is planned.

Before each use, idenflow checks that the admin account still belongs to your Google customer. Google admin accounts are left alone by default. For day-to-day running we recommend a dedicated account with a custom admin role instead of a super admin.

Sign-in, roles and connections

Only Google Workspace accounts with a verified address can sign in, not personal Gmail accounts. Every 10 minutes, idenflow checks that signed-in people are still active in your Google directory; suspended people lose access.

Roles: owner, admin, approver and auditor (read-only); roles can also come from a Google group. Only owners and admins change rules and playbooks. Approvers approve, auditors only read.

Only an owner can change the connections to Personio and Google. The Personio secret is not shown again after it is saved. Credentials are encrypted with a key of their own per organisation, and each organisation is isolated in the database.

Your data

Your data of record stays in Personio and Google Workspace. The app works with a copy: the Personio fields it uses and each account's Google directory record.

From Personio, idenflow keeps core data such as name, status, start and leaving dates, manager, department, team, office, position and cost centre. Custom Personio attributes are kept only while a rule, playbook or setting uses them. In Personio, idenflow adds a webhook when you connect; the only data it writes there is the Google address, into a custom attribute, if you want that.

People and accounts removed from Personio or Google, and the change events read from Personio, are deleted after 13 months; a person with an open run only after it ends. The audit log is kept until the organisation is deleted. An owner can delete the organisation with all its data at any time, audit log included.

For data protection and the works council, idenflow generates a system description from your configuration: fields read and written, rules, playbooks, roles, retention and the services involved.

Operation

Production is planned on Google Cloud in Frankfurt (europe-west3); the database, the app and its secrets will sit in that region. Planned: daily database backups with 30 kept; deleted data stays in backups until they expire.

Google Cloud is the planned sub-processor for production. Personio, Google Workspace and, if connected, Slack are your own accounts. Mail goes out from your own Google mailbox, not through a third-party mail service.

Who is behind it

Weidhaus, a sole proprietorship in Germany, makes idenflow. One person builds and runs it. It is built and tested, but not yet in use at any customer. Full provider details are in the legal notice (Impressum, in German).