Security review
The controls, the code behind them, and the gaps we publish first
- Position
- Pre-launch, holding no security certifications. SOC 2 Type II and ISO 27001 are in preparation.
- Method
- Each control below is implemented in the product and traceable to the file that implements it.
- Gaps
- Where a control a reviewer would expect is missing, we write it down rather than leave the topic out.
- 01
Tenant isolation
The first question in every security review is whether another customer can reach your data. Your organisation is resolved from the verified credential, never from a URL. Composite foreign keys draw the same boundary in the database, so a record cannot reference another tenant even if application code tried to write one.
- 02
Tamper-evident trail
When a decision is challenged — a dismissal, a client dispute, an audit sample — you need a record nobody can quietly edit afterwards. Governance changes, data access and our own staff actions each append to a SHA-256 hash chain. Database constraints make a forked chain impossible, and you can re-verify any chain yourself through the API.
- 03
Immutable anchoring
Evidence is only evidence if it outlives the person who would rather it did not. Chain heads are anchored to object storage under S3 Object Lock in COMPLIANCE mode, which cannot be deleted early even by the account root. If the anchor store is unreachable, the production API refuses to start rather than quietly stop anchoring.
- 04
AES-256-GCM
The encryption row on your questionnaire, answered precisely rather than with the word "encrypted". Integration credentials, single sign-on secrets, two-factor seeds and signing keys are sealed with authenticated AES-256-GCM, and production will not boot without the key. Our full encryption posture, including what is not yet encrypted, is in the security overview.
- 05
Subject requests, self-served
A subject-access request lands on HR and legal as a fortnight of manual collation, and a works council asks the same questions again. Monitored employees get self-scoped access to what is captured about them, to who viewed it, to consent controls, to a private-time pause they run themselves, and to a dispute that freezes automated re-decision while it is open. The request is answered by the product, on the record.
- 06
Certifications: none yet
If a certificate is a hard gate in your procurement, we are not through it: WorkMonitor is pre-launch and holds no certifications. SOC 2 and ISO 27001 are in preparation. What your reviewer gets in the meantime is our control inventory with source references and our open gap list, rather than a badge we have not earned.
Evidence
Numbers you can recount yourself
Most security pages quote figures about the vendor. These count the product: the controls that sit in the codebase, and the tests that stop one regressing quietly between releases. WorkMonitor is pre-launch, so there are no customer statistics to quote, and none are invented here.
| Count | What it counts | Checked against |
|---|---|---|
| 310 | server-side checks that a record belongs to your organisation before it is returnedapps/api/srccalls to assertOrg(), counted across every file in the API | apps/api/srccalls to assertOrg(), counted across every file in the API |
| 31 | composite foreign keys enforcing tenant isolation in the database itselfpackages/db/prisma/schema.prismarelations declared references: [id, orgId] | packages/db/prisma/schema.prismarelations declared references: [id, orgId] |
| 3 | independent SHA-256 hash chains: governance, data access, and our own staff actionspackages/db/prisma/schema.prismathe AuditLog, AccessLog and StaffAuditLog models | packages/db/prisma/schema.prismathe AuditLog, AccessLog and StaffAuditLog models |
| 0 | keystrokes recorded: all three desktop agents count key presses and never read their contentnative/macos · native/windows · native/linuxeach agent key-down handler, which increments a counter and reads nothing | native/macos · native/windows · native/linuxeach agent key-down handler, which increments a counter and reads nothing |
None of these figures is typed by hand. Each is recounted from the source beside it by a test that fails when the two disagree, so a number that drifts away from the code breaks the build instead of quietly becoming a claim we cannot support.
- Proof Ledger
- Outcomes
- Certificates
- Audit log
- Data access
- Disputes
- Data egress
- Export
- What We See
- Controls
- AKAria K. viewed screenshotsLena M. · 3 capturesScreen capturemacOS · London09:42a91f…4c023d7b…91ee
- JMJon M. exported time reportDesign team · CSVmacOS · Berlin09:313d7b…91ee77c5…0ba4
- SDSara D. opened capture reviewRavi P. · one flagged frameWindows · Manchester09:1877c5…0ba4e208…5f13
- wm_live_7f2… read /v1/deliverablesScoped key · read onlyPublic API · allowlisted IP08:57e208…5f13b64a…2d90
- LMLena M. viewed her own recordWhat We SeemacOS · London08:44b64a…2d901cf9…8e77
- AKAria K. changed capture policyBlur set to alwaysmacOS · London08:261cf9…8e7705d2…ae31
Row 03, above
A chain is a line, and the database will not let it become a tree
Every entry carries the hash of the one before it, so an edit anywhere breaks each entry after it. Two PostgreSQL partial unique indexes enforce the shape at the storage layer: one genesis row per organisation, and at most one child per parent. An out-of-band insert is rejected by the database rather than caught in review.
Verification walks the rows in sequence and recomputes every hash, and it is exposed to you rather than run only by us. It is also erasure-aware and fails closed: a redacted row is accepted only if it names a real erasure receipt whose recorded count matches the rows attributed to it.
Row 04, above
Some switches are locked because there is nothing behind them
The capability set is closed. Six capabilities exist and nothing outside that list is modelled in the schema, so keystroke content is not a setting an administrator can reverse — there is no field for it to be written to.
What is capturable still has to clear four conditions at once: the plan entitles the capability, the resolved policy enables it, the clock falls inside the schedule, and where consent is required it has been granted. A person’s own private-time window is checked ahead of all four and returns nothing for every capability.
- Proof Ledger
- Outcomes
- Certificates
- Audit log
- Data access
- Disputes
- Data egress
- Export
- What We See
- Controls
- Screenshot captureEvery 15 min, working hours onlyWhole orgOn
- Blur before uploadBlurred on the device — the sharp frame never leaves itWhole orgOn
- Keystroke contentNot collected, and cannot be switched onWhole orgUnavailable
- Private timeAnyone can pause capture; the pause is logged, the screen is notDesign teamOn
Why this page reads like a document
A control nobody outside this company can check is a promise, not a control.
So the inventory names files, the figures are recounted from the code by a test that fails when they drift, and the gaps are published beside the controls.
Trust Center
Everything your reviewer asks for.Including the gaps.
A review stalls in the round trip: a question goes out, a week passes, half of it comes back. The pack removes the round trip. Pre-written answers to the standard questionnaire, a control inventory where every claim names the code that implements it, our open gap list, and our data processing agreement. We hold no certifications yet, and that is the first line your reviewer reads rather than something they find late in procurement.
In the pack
- Security overviewEvery control, the file that implements it, and a marked gap wherever a control a reviewer expects is missing.
- Questionnaire answersWritten answers to the standard security questionnaire, so your reviewer starts from a stated position rather than a blank form.
Open gaps, as published
- No database row-level securityComposite foreign keys make a cross-tenant reference impossible. They do not stop a query that omits the organisation filter, so isolation still rests on application code above them.
- Anchor times are our own clockChain heads are written to storage that cannot be deleted early, but no third-party timestamp authority countersigns them yet.
- Verification runs on demandNothing schedules a chain verification today. A tamper is detectable whenever you or we ask, rather than detected automatically.
Three of the open items, from the same list we hand a reviewer. The pack carries the rest, each with the remediation phase it is booked into.