Security, in plain language
WorkOS holds salary data and client contracts. Here is exactly how it is protected — with no claims we cannot stand behind.
Built in, not bolted on
Properties of how the product is written — on every plan, including Starter.
Enforced access control
Permissions checked in the interface and again on the API.
Expiring sessions
Short-lived tokens — a stolen one is useful for minutes, not months.
Two-factor authentication
One-time codes at sign-in, so a leaked password is not enough.
A real audit trail
Every change logged with the user, the action and the time.
Hardened by default
HTTPS, rate limiting and validation on every input.
Least privilege
Disabled modules vanish from the app and return 403 on the API.
Control over where it runs
Hosted and managed for you
We run the servers, patching and monitoring. Enterprise gets a dedicated configuration.
Your data stays yours
Full export in a portable format, at any point. No lock-in.
Files handled properly
Uploads go to object storage via short-lived signed URLs.
Traceable operations
Structured logs, so incidents are reconstructed — not guessed at.
Help us keep WorkOS.Africa secure
If you identify a potential security issue, report it to [email protected] with steps to reproduce. We acknowledge reports within two business days and support good-faith security research.
What procurement always asks
Cannot find yours? Ask us directly — a person will answer.
Is WorkOS SOC 2 or ISO 27001 certified?
Not today, and we will not imply otherwise. We build to the controls those standards describe, and we will complete your security questionnaire or join your audit.
Where is our data stored?
On our managed hosting, in a region named in your contract. Enterprise customers get a dedicated server configuration — still hosted and managed by us.
Who at Hutstack can see our data?
A small number of engineers who operate the service, and access is logged. We never browse customer data or use it to train anything.
What happens when a staff member leaves our company?
Deactivate the user and their access ends immediately. The company keeps the full history — chat included.
Can we enforce two-factor authentication for everyone?
Yes, at the system level. Enterprise plans can also use your own single sign-on provider.
How do backups work?
Automated backups with a defined retention window, on every plan. Enterprise contracts can set custom schedules and retention.
Send us your security questionnaire
We will complete it properly rather than pointing you at a PDF.