This page reflects our current implementation, stated honestly — including what’s still in progress. For a signed copy, a full subprocessor list, or a DPA for your organization’s security review, email [email protected].
Data ownership
You own your data at all times — content, files, configuration you provide, and everything your AI agents generate (“AI Output”) — subject to a limited license for us to use it to provide, support, and improve the service for you.AI model training
We do not use your content — prompts, inputs, outputs, or uploaded files — to train or improve AI models for our general product or for any other customer, without your prior written consent. Where a request must route to a third-party AI model provider, we send only what’s necessary for that specific request, under that provider’s own data-handling terms.Encryption
- In transit: all traffic runs over TLS. Workser Desktop’s computer-use channel is authenticated with a scoped token, not an open connection.
- At rest — secrets and credentials: protected with envelope encryption (AES-256-GCM), a random initialization vector per encryption call, and a versioned key scheme that supports rotation without re-encrypting historical data. Connected-app credentials in our workflow engine use AES-256-CBC with a random IV per record — we’re working to align this to the same standard used elsewhere in the platform.
- API keys: stored as one-way hashes, never in reversible form.
- Workser Desktop: locally cached credentials are encrypted using your operating system’s native secret store (macOS Keychain / Windows DPAPI), not plaintext on disk.
Access control
- Multiple authentication mechanisms depending on context (scoped API keys, desktop-bridge tokens, user session tokens).
- Scoped API keys separate management actions from routine agent operations — destructive actions like deleting a project require a real user session or a management-scoped key, never a routine automation key alone.
- Organization roles (
owner / admin / member / viewer) govern who can manage members, billing, and destructive actions. - Rate limiting is enforced per API key.
Workser Code execution and approvals
Workser Code’s coding agents operate in a local project workspace. Connected agents use their configured model providers; the built-in agent uses Workser-managed model access and metered credits. Source sync, shared project records and deployments use cloud services, so this is not a local-only data guarantee. The desktop has enforced approval gates for production deployment, live payment operations and protected database or bucket deletion. Other actions depend on the run’s autonomy and permissions. These desktop controls are separate from the older hosted AI Employee flow described below and from SDK calls made by a deployed app. See Security & approvals.Hosted AI agent safety controls
The following controls describe the hosted AI agent path. Do not assume its sandbox model applies to local coding agents or that its approval behavior applies to every product.Sandbox isolation
Sandbox isolation
AI agents that write or run code do so inside ephemeral, per-task sandboxes, explicitly destroyed at the end of a run — never reused across customers or tasks.
Secret redaction
Secret redaction
Any sandbox output or file content returned to the model is scanned and masked for secret-shaped values (API keys, tokens, database URLs) before the model can see it — including if you explicitly ask for it.
Prompt-injection guardrails
Prompt-injection guardrails
Agent system prompts explicitly instruct the model to treat uploaded files and tool output as untrusted data, not instructions, and to refuse embedded attempts to exfiltrate secrets or change scope.
Human-in-the-loop
Human-in-the-loop
Agents can pause and request your approval before proceeding on a sensitive action, with a configurable wait window. Today this is agent-invoked — we’re working toward a platform-enforced mandatory gate for a defined list of high-risk actions; if that’s a requirement for your organization, tell us and we’ll confirm what’s configured for you.
Computer-use approval
Computer-use approval
Computer-use actions (screen control, keyboard/mouse, file/shell access) are gated by per-action approval prompts to the device owner — nothing executes without your explicit approval.
Multi-tenancy and data isolation
Every project on a paid Workser plan gets its own dedicated database and file storage — not a shared schema with other customers. Free-tier projects currently share infrastructure as a cost trade-off and are not database-isolated from one another. If dedicated isolation is a requirement for your organization, our paid tiers already provide it.Data deletion
When you delete a project, we tear down the underlying database and file storage for that project. The project record itself is archived (not row-deleted) for a limited period to preserve billing, support, and audit history. We can provide a written deletion confirmation once a request is fully processed — today this is a manual process on request; we’re working toward a self-serve version.Monitoring and incident response
We monitor for application errors and anomalous activity across our services, and maintain an internal process to investigate, contain, and notify affected customers of any confirmed security incident affecting your data.Compliance program status
See our current compliance status
SOC 2, ISO 27001/27701/42001, DPA — stated honestly, updated as it changes.
Subprocessors
See our subprocessor list
Every third party that processes your data on our behalf, and why.
Getting Workser approved on your network
Enterprise Network & IT Requirements
Domains to allowlist, and honest status on SSO, egress IPs, and audit log export.