What this pack covers
Everything Harborline's IT security and procurement review needs to evaluate RelayWorks for all service teams, organized by domain, with the questions still open. Prepared by Rachel Kim with RelayWorks security for Nadia Ortiz.
- Vendor
- RelayWorks
- Product in scope
- RelayWorks workflow platform, Business plan
- Hosting
- US regions only, primary and warm standby
- Compliance
- SOC 2 Type II, period ending Jun 30, 2026
- Data classification
- Handoff records and account names. No payment data.
- Prepared for
- Harborline Logistics, review dated Sep 23, 2026
Controls summary
| Domain | Control | Status | Evidence |
|---|---|---|---|
| Access control | SAML SSO, enforced MFA for all RelayWorks staff | Implemented | SOC 2 report, section 4 |
| Provisioning | SCIM user and group sync from your identity provider | Implemented | Business plan feature, tested in pilot |
| Encryption | AES-256 at rest, TLS 1.2 or higher in transit | Implemented | Penetration test summary |
| Logging | Admin and access audit log, 12 months on Business | Implemented | SOC 2 report, section 5 |
| Vulnerability management | Annual external test, continuous scanning | Implemented | Latest test, Jul 2026 |
| Business continuity | RPO 1 hour, RTO 8 hours, annual failover test | Watch | Failover test report due Oct 2026 |
Security domains in detail
Access control and identity
Harborline users sign in through your identity provider. Regional teams map to RelayWorks teams through SCIM groups, so a leaver loses access when your directory changes. RelayWorks staff reach customer data only through a ticketed support session you can see in the audit log.
Encryption and key management
Data is encrypted at rest and in transit. Customer managed keys are an Enterprise plan option and are not part of the recommended Business plan.
Data residency and subprocessors
All processing and storage stays in US regions. Four subprocessors: cloud hosting, transactional email, error monitoring and support ticketing. The list with data flows is available on request.
Incident response
Security incidents affecting Harborline data are reported to your named contact within 48 hours of confirmation, with a written summary within 5 business days.
How Harborline data flows
The pilot set the boundary and the rollout keeps it: RelayWorks holds the shared handoff record, the owner and the acknowledgment task. Your dispatch system stays the system of record for jobs, and RelayWorks only reads a dispatch job reference.
Stored in RelayWorks
- Handoff record, owner, status and waiting reason
- Customer account name and region
- User names and team membership from SCIM
Never imported
- Personal customer contacts
- Contract rates
- Anything that writes back to dispatch
Documents we can provide on request
- SOC 2 Type II report, under NDAdone
- Penetration test summary, Jul 2026done
- Subprocessor list with data flowsdone
- Data processing agreement, Harborline markupopen
- Failover test report, Oct 2026open
Open questions
| Question | Owner | Status |
|---|---|---|
| Which directory groups map to the 14 regional service teams? | Nadia Ortiz, Harborline IT | Waiting on Harborline |
| Retention for closed handoffs: Harborline asks for 3 years, default is 2 | Rachel Kim | Offered in contract |
| Can the after hours duty manager group be excluded from SSO session limits? | Omar Lewis | Answer by Oct 2 |
Next steps
- Pack sharedSep 23
- SSO and SCIM detailsHarborline IT, Sep 30
- Questionnaire returnedOct 3
- Security sign-offNadia Ortiz, Oct 7