Trust Center
Welcome to Woba’s Trust Center.
Woba is a Danish SaaS platform for employee wellbeing and work environment assessments. We process personal data on behalf of our customers, and we treat that responsibility as a core part of how the platform is built and operated.
Our security and privacy work is documented, not just stated. We undergo an annual ISAE 3000 engagement carried out by an independent auditor, we have penetration testing performed by an external party, and our data is hosted within the EU.
Use this Trust Center to review our security posture, our subprocessors and our certifications. Policies and reports are available on request.
Hillerød Kommune
Howden
Naturstyrelsen
WTW
EKJ CONSULTING ENGINEERS AS
DLA Piper
Pandora
Lund Elmer Sandager
DSV
Abacus Medicine Group
Arp-Hansen Hotel Group
Dansk Sundhedssikring
Tryg
SOS
Hillerød Forsyning
DR
SPORT 24
Matas
Trust Center Updates
Heroku, application hosting
Customers onboarded from 6 November 2026 onwards do not use Heroku.
Woba is phasing out Heroku as a sub-processor. The service will be decommissioned on 30 December 2026, after which application hosting is provided exclusively by Scalingo SAS on infrastructure located in France. Until that date, Heroku remains in use for part of Woba’s application hosting, with data hosted in Frankfurt, Germany. No customer data will remain with Heroku after decommissioning.
No impact from the critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619)
On 21 October 2026 the PHP project released emergency patches for two critical remote code execution vulnerabilities in PHP core, CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2 and referred to publicly as “PHP2Shell”. The flaws affect PHP 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27 and 8.5 before 8.5.12. Public proof-of-concept code exists and exploitation attempts have been reported.
Woba has assessed the vulnerabilities and is not affected.
No Woba system runs PHP. Our public website is built and hosted on Webflow, a fully managed platform where no PHP runtime is exposed to or operated by Woba. The Woba platform itself runs on our managed PaaS providers on a stack that does not include PHP, and Woba operates no local servers or on-premise equipment.
No action is required from customers, and no customer data has been affected. Woba monitors security advisories continuously and will publish an updated notice here if our assessment changes.
Assessed 23 October 2026 by Woba’s Data Protection Officer.