Workplace software holds more sensitive data than most buyers assume: who was in which building on which day, who they met, their movements between zones, and often biometric or ID data from visitor check-in. Evaluating it means treating it as a security purchase, not just a facilities one.

• Certifications as the baseline: ISO 27001 for information security management, ISO 27701 for privacy, and SOC 2 Type 2 for operational controls are the standard. Ask for current reports rather than logos on a website, and check the audit scope actually covers the product you’re buying.
• Identity and access: Insist on SSO through SAML, SCIM provisioning so leavers lose access automatically. Then examine role-based access control in detail: a facilities manager in Mumbai should not have to see attendance data for the Berlin office, and viewing data should be a separate permission from changing configuration.
• Data residency and retention: For multi-country deployments, confirm where data is stored and processed, and whether region-specific hosting is available. Check that retention periods are configurable per data type, and that deletion actually deletes rather than soft-flags.

• Integration security: The platform will connect to your identity provider, calendar, HRIS, and access control system. Ask how credentials are stored, whether integrations use scoped tokens rather than admin accounts, and what happens to synced data if you disconnect.
• Operational maturity: Request the vendor’s incident response process, breach notification commitments, penetration test cadence, and uptime history. Ask about subprocessors, since your data likely touches more than one company.
• Audit trails: Every configuration change and data export should be logged with user and timestamp, and those logs should be exportable for your own review.

Run this as a joint evaluation with your security and privacy teams from the start.