Greetly security
Built on trust, designed for peace of mind
Your visitor management system handles sensitive data — from guest identities to employee directories. That’s why Greetly is built with enterprise-grade security practices to protect your people and your information.
Data protection you can count on
All visitor data is encrypted end-to-end using industry best practices.
Global Admin, Location Admin, Security, and Employee roles ensure the right level of access for the right people.
Support for SAML 2.0 providers like Okta and Azure AD ensures secure and seamless authentication.
Automated sync with Azure AD, Google Workspace, and Active Directory reduces risk of outdated records.
Privacy and compliance
Greetly is fully GDPR-compliant, giving EU customers confidence in data handling.
Clients can configure Visitor Log deletion policies or request data purges at any time.
Choose where your data resides, with options that align to your organization’s regional requirements.
Transparency for IT leaders
We know security is a top priority for IT and compliance teams. For detailed documentation, including penetration testing, security reports and policies, please visit our Trust Site for all OfficeSpace companies, including Greetly by OfficeSpace.
For any questions, please contact [email protected].
FAQ
PII and privacy in Greetly
Need to know more about Greetly’s security? Browse our trust center FAQs:
Depending on your configuration which is customizable, you may use Greetly to collect:
- Visitor and employee names, email addresses, phone numbers, and company details
- Photos (captured at check-in)
- Digital signatures on NDAs, waivers, or acknowledgements
- Configurable ID scanning, including photos
- Custom fields such as department, citizenship, or clearance level
All PII is securely stored in Greetly’s cloud environment, with hosting options in both the EU and North America to meet regional compliance requirements.
All data in Greetly is encrypted in transit and at rest, ensuring that sensitive visitor and employee information is protected end-to-end. Greetly also protects visitor PII data with:
- Role-based access controls: Only authorized admins can view or export data
- Audit logs: All check-ins, check-outs, and changes are logged for accountability
Admins can configure data retention policies to automatically delete Visitor Log entries after a set period, or request manual purges at any time.
Yes. Greetly supports SAML 2.0-based SSO with providers such as Okta and Azure AD, allowing secure authentication for employees and admins.
No. User provisioning is not SCIM-based today. Users can be added manually, uploaded via CSV, or synced via directory integrations such as Azure AD, Active Directory, or Google Workspace.
Yes. Greetly offers hosting options in both the European Union and North America, enabling organizations to select where their visitor data is stored to meet regional compliance requirements.
Yes. Greetly is fully GDPR compliant, including configurable data retention, consent messaging, and visitor log deletion to align with EU privacy regulations.
Yes. Greetly aligns with the California Consumer Privacy Act (CCPA) by providing transparency in what data is collected and allowing admins to configure deletion of visitor records or request purges on demand.
Retention is fully configurable by admins. You can set Visitor Log deletion policies to automatically remove records after a defined period, or manually purge data at any time.
Yes. All visitor check-ins, check-outs, and admin changes are logged for visibility and compliance reviews. These logs can be exported for audits or investigations, and logs can be automatically distributed via email to admins and other stakeholders for on-site visibility.
Greetly does not currently publish SOC 2 or ISO 27001 certifications. However, as part of the OfficeSpace family, Greetly follows enterprise-grade security practices and benefits from the same security posture. For detailed documentation and certifications, IT leaders should visit our OfficeSpace Trust Center.
Yes. Regular penetration testing is conducted as part of Greetly’s security program, aligned with OfficeSpace standards.
Greetly APIs are secured via API keys. The platform also supports OpenAPI 3.1, though custom API integrations beyond Zapier are limited.
Yes. Greetly supports check-in webhooks that send structured visitor data to external systems via HTTPS POST requests. Webhooks must be explicitly enabled per location.
Greetly applies standard application security practices, including input validation, data encryption, and hardened authentication. For specifics, refer to penetration test results available on the Trust Site.
Yes. Greetly runs in a secure, cloud-hosted environment with hardened infrastructure. Hosting is available in both EU and North America regions.
Yes. Greetly provides both watchlist and blacklist functionality. Watchlisted visitors trigger alerts; blacklisted visitors are prevented from check-in.
Greetly supports internal watchlists/blacklists only. It does not support real-time screening against external databases.
Badge printing is limited to essential check-in details. ID scanning is supported for U.S. driver’s licenses only, and only the data fields (not images) are captured and stored securely.
Yes. NDAs and other agreements can be signed digitally during check-in and exported in PDF format from the Visitor Log.
Yes. Evacuation alerts are sent by SMS and email to employees and visitors. Responses (“I am safe”) are logged and visible to admins for accountability.
Greetly operates with high uptime as part of OfficeSpace’s cloud environment. For enterprise clients, uptime commitments can be reviewed with Customer Success.
As part of the OfficeSpace family, Greetly follows established business continuity and disaster recovery processes, ensuring resilience and quick recovery in the event of an outage.
Yes. Greetly customer support is available 24/7 via email and phone. Critical escalations are routed through OfficeSpace’s support and security teams.
Vulnerabilities are managed via OfficeSpace’s security team. Disclosures can be submitted through [email protected] and patches are prioritized based on severity.