Keeping sensitive information private

Some of what you collect is more private than a shirt size: a tax file number, bank details, a passport, a police check. Mark a request or a contact field Sensitive and WorkZerk treats those answers differently from everything else. They are stored encrypted, hidden from your team, visible in full only to admins, and every view is recorded.

What Sensitive does

For a sensitive request or field:

• The answer is masked everywhere. On the portal, the Requests screen, the contact record and in reports, a sensitive answer shows as dots with the last three characters, for example ••••• 782. A date shows as ••/••/••••. Anything four characters or shorter shows as dots only.
• Only admins can see it in full. An admin clicks View beside the masked value to see it. That is you as the account owner, and any teammate whose access is set to Admin. See "Who can view it" below.
• Every view is recorded. Each time someone views an answer or opens a sensitive file, WorkZerk records who, when, and from which IP address. See "The access log" below.
• Files open only for admins. A sensitive upload shows its file name to everyone, but only an admin can open it. An image, such as a photo of a passport, is never shown as a thumbnail.
• It is stored encrypted. The answer or file is encrypted before it is saved, with a key held separately from the database. See "How the encryption works" below.
• It stays out of emails and totals. The "requests complete" email says a sensitive answer was provided but does not include it, and a sensitive number field is not added up in totals.

Everything else works as usual. A sensitive request can still be required, chased, reviewed, approved or rejected, carried in a request pack and saved onto a contact field.

Which requests can be sensitive

A Text, Date or Upload request can be marked Sensitive. So can a custom contact field of the type Text, Date, Number or Upload.

Choice, Terms, Sign PDF and Tasks cannot. A choice or a signature is not private in the same way, and a task only records that something was done.

A Fields request takes its setting from the field it saves to, because the answer lives on the contact record and shows on every portal that asks for it. To make it sensitive, mark the field itself sensitive on the Fields page. Every request that saves to that field becomes sensitive at once.

Marking a request sensitive

On a new request: tick Sensitive in the add form, beside Required.

On an existing request: tick Sensitive on the request's row in the portal's Requests panel. Answers already collected are encrypted in the background within a minute or two.

On a contact field: go to Fields, open the field and click Mark as sensitive.

In a request pack: open the ask in the pack and tick Sensitive. Every portal the pack is added to gets the request already marked.

The starter packs already mark the asks that need it: tax forms (TFN declaration, IR330, P45, W-4, W-9, I-9), bank account numbers, super member numbers, proof of the right to work, police and DBS checks, National Insurance numbers and UTRs. See Starter request packs.

Turning it off

Unticking Sensitive shows every answer to that request, or every value of that field, to your whole team again, and decrypts what is stored. So only an admin can do it, and WorkZerk asks you to confirm first. The change is recorded in the access log. The same goes for unlinking a document request from a sensitive upload field, since its files would no longer be sensitive.

Who can view it

On the Team page, each person with access to your account is an Admin or a Member:

• Admin can do everything, including viewing sensitive answers and opening sensitive files.
• Member can do everything else: build portals, send and review requests, approve uploads, manage contacts. Sensitive answers stay masked for them, and sensitive files will not open.

Everyone you invite starts as an Admin. To change someone, pick Member from the list beside their name on the Team page. The change applies from their next click.

Our support team never sees sensitive answers, even when helping you from inside your account.

What the person sees

On their own link, the person sees their sensitive answer masked too, with a pencil to change it. To change it they type it again in full: the box does not fill in with the old value. They already know their own tax file number, and a link can be forwarded or left open on a shared computer.

Sensitive files and the AI expiry date check

Marking a request Sensitive does not switch off the expiry date check. WorkZerk still reads the expiry date on a sensitive file and compares it with the date entered, and each read is listed in the access log as Automatic expiry date check, with Automatic in the Who column. To keep a file from being read at all, tick Don't use AI to check expiry date on the request or on the contact field it saves to.

The access log

Go to Reports > Sensitive information access to see every time someone:

• viewed a sensitive answer
• opened a sensitive file
• downloaded an export or submitted files with sensitive information included
• marked a request or field sensitive, or turned it off

It also lists each time the AI expiry date check read a sensitive file.

Each entry shows when, who, what they looked at, whose answer it was, the portal, and the IP address. You can filter by date, print it, or download it as a CSV. Only the account owner and admins can see this report.

Exporting your data

The account export writes each sensitive answer as (sensitive), and leaves out sensitive files you attached to contacts. The submitted files download leaves out sensitive files people uploaded to your requests. To include them in either download, tick the sensitive information box and enter your password. The download is recorded in the access log, and we email you a record of what it included. See Exporting your data.

How the encryption works

When a sensitive answer is saved, WorkZerk encrypts it before it reaches the database. The encryption key is held in a separate storage account, never in the database. So a copy of the database, or a backup of it, only ever holds scrambled text for sensitive answers.

An uploaded file is first checked for viruses, which takes a few seconds. It is then encrypted in storage. Until the check finishes the file cannot be opened, and you see "still being checked" if you try.

WorkZerk decrypts a value only when someone allowed to see it asks to, which is why every view is recorded. This is field-level encryption, not end-to-end encryption: WorkZerk itself can read the value in order to show it to your admins.

Deleting sensitive information automatically

Sensitive information is kept until you delete it. To change that, open Profile and find the Sensitive information card. Choose to delete it 30 days, 90 days, 1 year, 5 years or 7 years after a portal closes.

When the time comes, WorkZerk deletes the sensitive answers and files on that portal. The rest of the record stays: who answered, when, and that the request is complete. Each answer reads "Removed on" and the date, and each file shows that it was deleted under your retention setting. Answers saved onto a contact from those requests are removed too, but a value you typed onto a contact yourself is kept, and so is a file you attached to a contact yourself. If another open portal was relying on a removed contact value, that request shows as not provided yet and the person is asked for it again there.

You get an email 7 days before anything is deleted, listing each portal. Information already older than the period you choose is deleted 7 days after that email, not straight away. An open portal is never deleted from, and reopening a closed portal stops the clock. Each deletion is recorded in the access log.

Copies held in our backups are encrypted and are gone within 35 days of the deletion.

Tax file numbers in Australia

If you collect tax file numbers, the Privacy (Tax File Number) Rule 2015 applies to you whatever the size of your business. It asks you to protect TFNs from misuse and unauthorised access, limit who can see them, and destroy them once no law requires you to keep them. Marking a TFN request sensitive covers the first two, and the retention setting above covers the third. Employers generally have to keep payroll records, including TFN declarations, for several years, so check what applies to you before choosing a setting.

Getting help

If something here does not match what you see on screen, email [email protected] and we will take a look.