You can see
- How many joined, and how many are active
- How a challenge is going, as group totals
- How many people fall in a group, health risk included
- Trends across the whole workforce
Employee data privacy, and where it lives.
Your company gets its own space. You pick the region that holds the data. You see group totals, never one person's health.
Your tenantSeparate and in region
- Your own spaceEvery record tied to your companySeparate
- Data regionUS, set when you sign upIn region
- Health dataNever on an admin screenEmployee only
Illustrative sample data.
Vantage Fit keeps each company's data in its own space, held in the US, Canada, the EU, the UAE, or India. You pick the region. Admins see group totals with no names attached. Health records, vitals, and lab results stay private to the employee.
Your data stays yours, in the region you pick.
Each company gets its own walled-off space. Every search stays inside it. You pick where the data lives.
- United States
- Canada
- European Union
- UAE
- India
Your records never mix with anyone else's
Every record is tagged to you, and a search cannot reach past your own data, whichever screen or export it comes from.
You pick where the data lives
Choose the US, Canada, the EU, the UAE, or India when you sign up. The data stays there and is served from that region.
Group totals, never the person
Admins see how many people joined, by team and across the company. They never see one person's health data.
Exactly what you can see, and what you cannot.
Admins see how the group is doing. No admin screen or export shows one person's weight, sleep, blood pressure or mood.
Individual health data remains employee-only.
You cannot see
- One person's steps, sleep, weight, or vitals
- A mood check-in, ever
- The names behind a health risk count
- A lab report, or the numbers in it
The controls your IT team will ask about.
How we handle sign-in, sessions, and the data itself.
Access and account controls
- SAML 2.0 single sign-on, tied to your identity provider
- The account locks after 5 failed password tries
- Reset links work once and then expire, and sign-in codes do the same, so an old link in someone's inbox is worth nothing
- The apps pin their SSL certificate, and admin sign-in adds a CAPTCHA
- Delete an account and we hash the name and email, then clear the tokens, so nothing traces back to the person who left
What we can and cannot claim
Your account team shares the security documentation during your review.
- ISO 27001 and ISO 27701 certified
- SOC 2, GDPR and HIPAA compliant, with a Business Associate Agreement (BAA) covering the lab report pipeline
- Regional hosting in the US, Canada, the EU, the UAE, or India
- A security and architecture paper for your IT team
Certifications and documentation
Our ISO certificates are available to download below. SOC 2 Type II, our DPA, BAA, and VAPT report contain sensitive detail and are shared with your security team on request.
- SOC 2 Type II report
- Data Processing Agreement (DPA)
- Business Associate Agreement (BAA)
- VAPT / penetration-test report
How is company data kept separate?
You get your own space. Your records and challenge data never mix with anyone else's. Every search is tied to you, so it cannot reach past that line. Health data reaches admins only as group totals.
Where is our data held?
Employee data sits in the data center you pick: the US, Canada, the EU, the UAE, or India. It stays in that region and is served from there.
Your security review, covered
For what this page does not cover, ask your account team. They hold the latest documentation.
Vantage Fit is ISO 27001 and ISO 27701 certified, and SOC 2 compliant. Download the ISO certificates from the Trust Center, or email security@vantagecircle.com for the SOC 2 Type II report.
Yes. We also sign a Business Associate Agreement (BAA) covering the lab report pipeline, which is where protected health information is handled.
In the region you pick when you sign up: the US, Canada, the EU, the UAE, or India, served from that region. EU hosting is available. Where the data sits and what we are certified for are two different things.
No. Admins see group and team numbers only. No screen or export shows one person's health data, lab values, or biomarkers. Health risk targeting returns a count with no names.
We hash the name and email, then clear the tokens. Past logs stay in your reports. You set the rule you want.
No. Recommended Actions follow fixed rules that we set. No model writes them. AI is used in 2 places only: group level leadership insights, and reading the text off a lab report. Neither one profiles a person for HR.
Yes. Send it through your account team. We will fill it in and set out the controls we run today.
Numbers for you. Privacy for your people.
Bring us the questions your reviewers will ask.
Walk through how we keep data separate, where it is held, and what you can see. Then take the security packet to your reviewers.