Harborline security review and procurement pack

A procurement and security team reviewing a vendor pack

Security pack Harborline Logistics RelayWorks

Owner: Rachel Kim. Updated Sep 23, 2026.

What this pack covers

Everything Harborline's IT security and procurement review needs to evaluate RelayWorks for all service teams, organized by domain, with the questions still open. Prepared by Rachel Kim with RelayWorks security for Nadia Ortiz.

Details
VendorRelayWorks
Product in scopeRelayWorks workflow platform, Business plan
HostingUS regions only, primary and warm standby
ComplianceSOC 2 Type II, period ending Jun 30, 2026
Data classificationHandoff records and account names. No payment data.
Prepared forHarborline Logistics, review dated Sep 23, 2026

This pack is confidential

Shared under the mutual NDA signed Aug 5, 2026. Please keep it within Harborline's evaluation team.

Controls summary

DomainControlStatusEvidence
Access controlSAML SSO, enforced MFA for all RelayWorks staffImplementedSOC 2 report, section 4
ProvisioningSCIM user and group sync from your identity providerImplementedBusiness plan feature, tested in pilot
EncryptionAES-256 at rest, TLS 1.2 or higher in transitImplementedPenetration test summary
LoggingAdmin and access audit log, 12 months on BusinessImplementedSOC 2 report, section 5
Vulnerability managementAnnual external test, continuous scanningImplementedLatest test, Jul 2026
Business continuityRPO 1 hour, RTO 8 hours, annual failover testWatchFailover test report due Oct 2026

Security domains in detail

Access control and identity

Harborline users sign in through your identity provider. Regional teams map to RelayWorks teams through SCIM groups, so a leaver loses access when your directory changes. RelayWorks staff reach customer data only through a ticketed support session you can see in the audit log.

Encryption and key management

Data is encrypted at rest and in transit. Customer managed keys are an Enterprise plan option and are not part of the recommended Business plan.

Data residency and subprocessors

All processing and storage stays in US regions. Four subprocessors: cloud hosting, transactional email, error monitoring and support ticketing. The list with data flows is available on request.

Incident response

Security incidents affecting Harborline data are reported to your named contact within 48 hours of confirmation, with a written summary within 5 business days.

How Harborline data flows

The pilot set the boundary and the rollout keeps it: RelayWorks holds the shared handoff record, the owner and the acknowledgment task. Your dispatch system stays the system of record for jobs, and RelayWorks only reads a dispatch job reference.

Stored in RelayWorks

  • Handoff record, owner, status and waiting reason
  • Customer account name and region
  • User names and team membership from SCIM

Never imported

  • Personal customer contacts
  • Contract rates
  • Anything that writes back to dispatch

Documents we can provide on request

Checklist
✓SOC 2 Type II report, under NDA
✓Penetration test summary, Jul 2026
✓Subprocessor list with data flows
Data processing agreement, Harborline markup
Failover test report, Oct 2026

Open questions

QuestionOwnerStatus
Which directory groups map to the 14 regional service teams?Nadia Ortiz, Harborline ITWaiting on Harborline
Retention for closed handoffs: Harborline asks for 3 years, default is 2Rachel KimOffered in contract
Can the after hours duty manager group be excluded from SSO session limits?Omar LewisAnswer by Oct 2

Next steps

✓Pack shared
SSO and SCIM details
Questionnaire returned
Security sign-off
  • Pack shared: Sep 23
  • SSO and SCIM details: Harborline IT, Sep 30
  • Questionnaire returned: Oct 3
  • Security sign-off: Nadia Ortiz, Oct 7

Demo deal room. RelayWorks, Harborline Logistics, the people, prices and every figure are fictional sample data. Built on FuseBase.