Trust Center · Enterprise grade
Enterprise-grade security. Proven in every review.
Security, privacy and compliance at GoJoe
GoJoe is the AI-powered health intelligence platform for global enterprise, built to clear enterprise security, privacy and procurement review. Employers see aggregated, de-identified data only. Each employee sees their own results and controls their privacy settings. GoJoe never sells user data.
GoJoe has never failed an enterprise security review.
Certifications and compliance
The standards your team will check.
ISO 27001 certified
Certificate 202503-051, issued by Sensiba Australia Pty Ltd. Certified since 27 March 2025, valid to 27 March 2028.
GDPR compliant
For employees in the UK and EU, with a data processing agreement for every client.
HIPAA-aligned
Controls aligned with HIPAA for US health information, with a 2026 HIPAA attestation. GoJoe signs Business Associate Agreements (BAAs) with US health plans.
SSO available
Employees sign in with the identity provider you already use.
Data flows
Who sees what.
- Employees see their own health, activity and screening results.
- Employers see aggregated, de-identified reporting only, never an individual's health data.
- Each employee controls their own privacy settings.
- GoJoe never sells user data.
Sees their own health, activity and screening results.
Reporting is built from groups, never from one person.
Sees aggregated, de-identified reporting only.
Documents
Everything procurement asks for.
Sub-processors
Our current sub-processor list is provided on request with the security pack.
Data processing agreement
Our standard data processing agreement is provided on request during security review.
Privacy policy
Request the security pack
Policies, certificates, penetration test summary and standard questionnaire answers, sent to your security team.
Request the security packSecurity at a glance
Security at a glance.
The controls security teams ask about first.
Hosting
Amazon Web Services, with Ireland (EU-WEST-1) as the primary region and data replicated across multiple regions for resilience.
Encryption
Production data is encrypted at rest, and all external data transmission is encrypted in transit.
Access control
Multi-factor authentication on every GoJoe system that supports it, and VPN plus MFA for remote access to sensitive data.
Monitoring
Cloud monitoring across the whole platform, with a security agent reporting suspicious activity to a central console.
Backups and continuity
Formal business continuity and disaster recovery plans, with backups taken at least weekly and held off-site.
Vulnerability disclosure
Security reports are acknowledged within two business days.
Frameworks
Certifications and frameworks.
How GoJoe’s security and privacy program is structured.
Information security
GoJoe App Limited holds a current ISO/IEC 27001:2022 certificate (202503-051), issued by Sensiba Australia Pty Ltd, certified since 27 March 2025 and valid to 27 March 2028. The scope covers the information security management system supporting the development, operation and support of the GoJoe platform.
Data protection
Built for UK GDPR and EU GDPR, with a data processing agreement for every client.
US health data
HIPAA-aligned practices for employers in the United States.
Independent penetration testing is carried out at least once a year. A summary is included in the security pack.
Privacy
Privacy and data protection.
Employee data is handled lawfully, minimally and transparently.
Data minimization
Only the data needed for a stated purpose is collected and processed.
Impact assessments
GoJoe carries out data protection impact assessments for high-risk processing and new technologies, and supports clients with their own.
Retention
Personal data is kept for up to two years after a member’s last login, then deleted.
Right to erasure
Personal data is deleted within 28 days of a valid erasure request, including from backups on the same schedule.
What employers see
Aggregated, de-identified reporting only, for groups of 25 people or more. Never an individual’s health data.
Never sold
GoJoe never sells user data.
Our sub-processor list and data protection contact are provided on request with the security pack.
Incidents
Incident response.
Prepared, logged and transparent.
GoJoe maintains a formal incident response policy and comprehensive audit logging across its systems. In the event of a personal data breach, GoJoe will notify affected clients and report to regulators as required under GDPR.
Security review
Request the security pack.
Policies, architecture and questionnaire answers for your security and procurement teams.
Questions, answered.
What is GoJoe?
GoJoe is the AI-powered health intelligence platform that helps global enterprises know their people better, get more from the benefits they already fund, and build a healthier workforce in every country they operate in. It is a corporate wellness platform that combines benefits navigation, wellness incentive and credit management, health risk assessments, rewards and team challenges in one system, used in 180+ countries.
Can our company see individual employees' health data?
No. Employers see aggregated, de-identified data only. Each employee sees their own results, including screening results, and controls their privacy settings.
Is GoJoe ISO 27001 certified?
Yes. GoJoe is ISO 27001 certified, GDPR compliant and HIPAA-aligned, with a 2026 HIPAA attestation, signs Business Associate Agreements (BAAs) with US health plans, and offers SSO.
Does GoJoe sell user data?
No. GoJoe never sells user data.
See GoJoe on your workforce.
A 30-minute walkthrough, set against your countries, your benefits and your people.