Security at WorkDone¶
WorkDone's products handle some of your organization's most sensitive material: internal documents, ERP data, and workforce activity telemetry. This section explains how that data is protected, how access is governed, and how to operate WorkDone products securely.
Security architecture at a glance¶
| Layer | How it's protected |
|---|---|
| Hosting | All services run on Microsoft Azure in hardened, containerized environments |
| Transport | TLS encryption for all traffic between your users, your integrations, and WorkDone |
| Storage | Encryption at rest for databases, documents, and telemetry |
| Tenancy | Organization-scoped isolation: your documents, data, analytics, and users are partitioned from every other tenant |
| Identity | Invitation-only provisioning with no self-signup; passwordless one-time-passcode sign-in; sessions in HttpOnly cookies |
| Authorization | Role-based access control enforced server-side on every request |
| AI boundary | Your data is used only to serve your organization, never to train AI models |
| Telemetry | Assessment outputs anonymized by default; identity keys delivered separately under controlled, logged access |
Identity and access¶
Access to WorkDone products is deliberately conservative:
- No public sign-up. Users exist only when an administrator invites them. Removing a user takes effect immediately.
- Passwordless authentication. Sign-in uses short-lived one-time passcodes sent to verified email addresses; there are no passwords to phish, reuse, or leak. Codes are single-use, expire in minutes, and are attempt-limited.
- Roles, not ad-hoc permissions. Corporate Memory uses four roles (Admin, Management, Automation, Member), each granting the minimum surface its function needs. Role checks run server-side on every request, not just in the browser.
See the Security & Access guide for how to run this well in your organization: least-privilege role assignment, joiner/leaver hygiene, and quarterly access reviews.
Data protection¶
- Your data stays yours. Documents ingested into the knowledge base, ERP records, and telemetry are processed solely to deliver the product to your organization. WorkDone does not use your data to train AI models.
- Integrations are least-privilege. Connectors to SharePoint, Google Drive, and your ERP are scoped to designated sites, folders, and file exchanges, and read-only wherever the workflow allows. You control the scope and can revoke access at any time. See Integrations.
- Human gates in front of AI. Documents entering the Copilot knowledge base pass an AI content review with a human approval queue, so your administrators decide what the AI can see.
- Workforce telemetry is governed. Observation scope and windows are agreed before collection; assessment reports anonymize participants by default. See Data Governance.
Operational security¶
- Vulnerability management. Container images are scanned for known vulnerabilities as part of every build, and findings are triaged against remediation targets.
- Change control. Production changes flow through peer-reviewed pull requests and automated pipelines; there are no ad-hoc production edits.
- Monitoring. Platform health and availability are continuously monitored with alerting to the engineering team.
Security-oriented guides¶
| Guide | What it covers |
|---|---|
| Security & Access | Least-privilege roles, provisioning hygiene, access reviews, protecting report links and OTP codes |
| Data Governance | Deciding what enters the knowledge base, handling sensitive documents, telemetry transparency and anonymization |
| Security & Compliance | Hosting, encryption, tenant isolation, the SOC 2 program, and responsible disclosure |
Reporting a security concern¶
If you believe you've found a security vulnerability in a WorkDone product, email support@workdone.ai with "SECURITY" in the subject line. Include what you observed and how to reproduce it; do not test against other tenants' data. We acknowledge reports promptly and keep you informed through resolution.