Security and privacy

Network Perspective Security and Deployment

Hybrid deployment model

Hybrid deployment is another model where a security critical part of the solution (NP_Sync) is deployed within your infrastructure.

Components deployed in vendor’s infrastructure process only anonymized data, delivering insights aggregated at a team level (min 5 people) and secured with SSO. 

NP_Sync

NP_Sync is a containerized app that syncs pseudonymized employee interaction metadata to enable Work Smart analysis.

It acts as a security and compliance layer that keeps all direct data access within your infrastructure.

It is easy to deploy, fully transparent, open sourced and auditable.

Goals

Security

Ease of deployment

Privacy & data protection

Security

NP_Sync is deployed behind a firewall with no access from outside.

All secrets (API keys, hashing key) are stored in a Key Vault enabling secure access and full audit trial. Cloud vendor specific Key Vault implementations are supported.

All code is open sourced and fully auditable.

Ease of deployment

NP_Sync consists of just one container and a Key Vault.

Due to simplicity it can be easily deployed in any major cloud like Azure, GCP, AWS but also Kubernetes or other environments that support Docker.

Deployment scripts for major clouds are provided by the vendor.

Privacy & data protection

All personally identifiable information is hashed using an irreversible HMAC algorithm with a key that is only in your possession.

NP_Sync accesses only metadata to extract employee interaction graph. No content of communication is ever processed.

Deployment, data and information flow

Apps where employees interact online offer APIs. 
NP_Sync access these securely with read only permissions to gather and recreate an interaction graph between employees

NP_Sync is a security and compliance layer that keeps sensitive data within your infrastructure.

It is simple, easy to deploy and can be hidden behind a firewall with no external access.

Work Smart is processing anonymous employee interaction graph to deliver insights & actions to your employees and managers, but also metric data stream to be used in your internal systems.

Data and information flow

  1. NP_Sync requests API access key and a hashing key from Key Vault
  2. Reads interactions from collaboration tool API
  3. Removes any PII and hashes identifiers with the hashing key
  4. Employee interaction graph is pushed to Work Smart api
  5. Work Smart analytical module processes anonymous data and computes over 100 metrics describing collaboration
  6. Metrics are presented via Web UI to end users, secured with SSO

SaaS deployment model

Alternatively your company can fully rely on our expertise and infrastructure. SaaS deployment model is the most convenient option where all pieces of the solution are managed by the vendor. Requires minimal involvement on your side, limited to authorizing read only API access to collaboration tools your company uses.

Ethics in Collaboration Analytics

What is Workplace Analytics?

HR analytics, also referred to as workplace analytics, workforce analytics, or talent analytics, involves gathering together, analyzing, and reporting HR data. It enables your organization to measure the impact of a range of HR metrics on overall business performance and make decisions based on data. In other words, HR analytics is a data-driven approach toward Human Resources Management.

Workforce analytics is an advanced set of data analysis tools and metrics for comprehensive workforce performance measurement and improvement. It analyzes recruitment, staffing, training and development, personnel, and compensation and benefits, as well as standardratios that consist of time to fill, cost per hire, accession rate, retention rate, add rate, replacement rate, time to start and offer acceptance rate.

HR analytics is important for 84% of companies
84% ofrespondents in the 2018 Global Human Capital Trends survey (DeloitteInsights, 2018) reported PA as being important or very important,making it the second highest ranked HR trend

Ethical issues in PA still atan early stage
Although the grey literature contains a growing stream of publications aimed at helping Workplace Analytics practitioners to “be ethical,” overall, research on ethical issues in Workplace Analytics is still at an early stage.

What are the ethical issues in HR analytics?
In HR analytics we collect and process data about people's characteristics and their behaviours. This kind of analytics brings ethical challenges and risks for employees' privacy, autonomy, and future work opportunities. Hence, strong ethics is needed.

What are the gains and risks for employees?
When it comes to people function and insights, it’s vital to ensure that employees know which data is collected and how it’s being used, and to assure them that it is being gathered for positive purposes. The people team should be transparent about what they do with data, and guarantee that there are effective privacy policies to protect employee data.  

It’s necessary for every business to put in place clear guidelines to explain what data can be collected and how it can be used, analyzed, and distributed.  

We’ve put together a list of best practices and preemptive actions that will help you reduce the risk of privacy violations: 

  • Maintain a clear distinction between personal and professional data.
  • Use necessary data only, give access to it only to those who need it for professional reasons, and remove it as soon as you no longer need it.
  • Be transparent about the data you collect and what you use it for.    
  • Use data only in good faith, to improve retention, and not to get rid of people. 
  • Make sure your employees consent to data gathering, and that they can opt out if possible. You can also ask them to fill in a consent form (here is an example). 
  • Put in place an effective process for people data analytics communication, feedback, and implementation (here is a good example).
  • Create a governance council that will make sure all your projects are run ethically. 
  • Co-create a code of practice with your employees and publish it so everyone has access to it.
  • Make sure you have legal support.
  • Consider using social listening tools to quickly catch emerging issues. 

To understand your PA security levels, it’s worth starting with a question – is your data stored and protected in a database that can’t be easily found? Also, is it encrypted, hidden away behind complex password policies, or other securitymeasures? 

Here are our top recommendations:

  • Engage with a technical team and hash, anonymize, and cube your data if possible.
  • Before your software becomes operational, run a series of security audits (for example, conduct a penetration test by simulating a potential hacker attack).
  • Limit the number of authorized personnel to the absolute minimum (you can export results from the system or provide team leaders with personalized reports describing their teams only; you don’t need to grant access to a large employee group).

As mentioned in our previous piece, our systems can only become as biased as we allow them to. Josh Bersin points out that if our existing data is biased, so will our software’s actions and recommendations. Therefore, it’s always best to assume that our PA tools come with their set of prejudice. 

So, how to ‘scan’ your system for traces of bias?
Here are a few best practices:

  • Make sure that your system’s AI guidelines are transparent and that its assumptions are easy to audit and optimize.
  • Create a data governance council, who will be responsible for data quality guidelines.
  • Consider using an automated bias detector tool; pair it up with a policy for AI accuracy best practices.
  • Collect feedback on the system’s predictability accuracy. Particularly, consider working on the so-called Virtuous Circle of Data Quality, which explains how employees can contribute with information to better train the system.
  • Create step-by-step procedures for when discrimination or bias are detected.
  • Take note of which HR decisions have been drawn up via algorithmic recommendations, should such data become necessary in the future.
  • Before you consider your insights’ as indicative and credible trends, ensure you’ve had min. 3 sets of similar data from a representative group of employees.

Your workplace analytics program should focus only on strategies that positively impact employees. For instance, if you’re tracking work productivity in the hopes of making the workplace better, then that’s perfectly OK. However, if you collect it to eliminate low performers, high chances are, you’re in violation of your company’s management principles.  

Josh Bersin mentioned that some companies use data to predict retention. If they spot employees who are thinking of leaving they start to give them unfavorable treatment. For instance, managers stop talking to them and reduce their support since they think it’s a waste of time as they’re going to leave anyway.  

Here are a few best practices that we recommend following to reduce the risk of imposing psychological harm on employees:

  • Make sure that Workplace Analytics positively impact your employees and enables leaders to make better informed leadership decisions on how to support their team members.     
  • Create a Management Disclosure Contract that explains what data the management will see, and how the network data will be used by the organization.
  • Also, make sure that it is an official document that has to besigned by the management and guarantee that the data will be used for positive purposes.

Here's the research we've done together with top experts:

How to measure employee experience in remote workplaces? →Best practices of active and passive employee listening from the 20+ top Workplace Analytics experts. →

Request DPIA (Data Protection Impact Assessment)

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.