Security and data.
Where the platform runs, how your organisation's data are kept apart from everyone else's, and what your people's wellbeing answers can and cannot become. Written for your IT and data protection leads.
Last reviewed 26 September 2026.
Hosted in Dublin.
The platform your people and your HR team use, its database and the email it sends all run in Dublin, Ireland.
Every record the platform holds, on Amazon Web Services in Ireland (eu-west-1).
The employee app and the admin portal, served from our app hosting provider's Dublin region.
Sign-in links, check-ins and notices, sent through Amazon Web Services in Ireland.
How it is protected
- Encrypted in transit: the platform and this website are served over HTTPS only
- Encrypted at rest: the database provider encrypts all stored data with AES-256
- Each organisation's records are kept apart by row-level security on every table in the database
- Roles are enforced in the database, not just hidden on screen: org admin, HR admin and line manager
- No passwords are issued. People sign in with a one-time link sent to their work email
- Sign-in links only work after a deliberate click, so mail scanners cannot use them up
- Documents sit in private storage and open through short-lived secure links, never public addresses
- Modules are switched on by our team, and the database refuses module changes from anywhere else
Wellbeing answers
- Results appear only as averages of five or more people
- That rule is enforced in the database. Below five, no figure is calculated at all
- An employee's individual answers are never shown to their employer
- There is no export of individual wellbeing answers, anywhere
- Employers cannot see who answered and who did not. Participation is shown as counts
- Your people's chats with our team are private: HR admins cannot read them
- No survey result is ever used to underwrite or price insurance
Who processes data for us.
The services that host or send data on our behalf, what each one does, and where.
| Service | What it does | Region |
|---|---|---|
| Cloud database, on Amazon Web Services | The platform database | Dublin, Ireland |
| App hosting | The employee app and the admin portal | Dublin, Ireland |
| Email delivery, on Amazon Web Services | Email from the platform | Dublin, Ireland |
| Cloud database, on Amazon Web Services | The Intelligent Wellbeing Engine reference service and sandbox | London, UK |
| Cloud database, on Amazon Web Services | Forms and tools on this website | Frankfurt, Germany |
| Website hosting | This website | Pages from a global network; forms handled in Washington, D.C., US |
| Code hosting | Our source code | United States |
The full named list of our sub-processors is in our data processing agreement, or on request from hello@alltoogether.com. How we handle personal data is set out in our privacy policy.
Found something? Tell us.
Our vulnerability disclosure policy sets out what to include and what happens next. We acknowledge every report within 48 hours.
Questions from your IT team?
Bring them to a call with Zak or Rachel, or send them to us in writing first.