Security
Three independent layers, each assuming the other two have a bug.
Workspace isolation is the property everything else in Workden depends on, so it is not implemented once and trusted. It is implemented three times, in three different places, by three different mechanisms.
Isolation
How your workspace stays yours.
01
Scope comes from your session
The workspace identifier is read from your signed session token and from nowhere else. It is never taken from a URL, a query string or a request body, so there is no identifier to tamper with.
02
The query layer adds the filter
Every database call for workspace-owned data is rewritten to include the workspace filter before it runs, and any value supplied by the calling code is overwritten rather than trusted. A developer cannot forget the filter, because they never write it.
03
The database refuses anyway
PostgreSQL row-level security policies compare every row against the workspace established for that transaction. If the two layers above both failed, the database returns nothing rather than another customer’s records.
Asking for a record that belongs to another workspace returns “not found” — never “forbidden”. A 403 would confirm the record exists.
Access
Authentication and authorisation
- Passwords are hashed with argon2id — a memory-hard algorithm chosen specifically to make offline cracking expensive.
- Sign-in attempts are throttled per account and per address, and repeated failures lock the account temporarily.
- Sign-in takes the same time whether or not the account exists, so the form cannot be used to discover which email addresses are registered.
- Every route is private by default. A new page is protected because nobody opted it out, not because someone remembered to protect it.
- Permissions are checked on the server for every action. The interface hides what you cannot do; the server is what actually refuses it.
- Team invitations expire, are single-use, and only a hash of the token is stored — a copy of the database yields no usable invitations.
Infrastructure
Where your data lives
- The database is not reachable from the public internet. It listens on the loopback interface only.
- The application connects as a role with no superuser rights, which is what makes row-level security apply to it at all.
- HTTPS everywhere, with a strict Content-Security-Policy.
- Workden never sees or stores card details. Checkout and billing are handled entirely by Stripe, on Stripe's own pages.
- Encrypted database backups are taken nightly and retained.
- Error responses are generic. Diagnostic detail goes to the server log, never to the browser.
AI boundary
AI should work for your business. It shouldn't work around your security.
Workden never gives AI unrestricted database access. The connectors are still being built, but the boundary they will run inside already exists — and it is the part worth checking before you trust any AI CRM.
- AI acts as a person, inheriting their workspace, role and module permissions exactly. There is no service account with broader access.
- Data minimisation: only the fields needed to answer a request are sent. Not the whole record, and never the whole database.
- Credentials, tokens and secrets are never part of any AI context.
- An AI model is never given direct database access.
- Analytics is a separate boundary with the same rule: no names, no email addresses, no deal values and no notes ever leave as event properties.
Honestly
What we will not claim.
No system is absolutely secure, and a vendor who tells you otherwise is selling you something.
- We do not hold a formal certification such as SOC 2 or ISO 27001 today. When we do, this page will say so and name the auditor.
- Two-factor authentication is not available yet. Account security today rests on argon2id password hashing, throttling and lockout.
- The controls described above are the ones actually implemented in the product. We would rather list fewer and have each be true.
Found something?
If you believe you have found a security issue in Workden, please tell us before telling anyone else. We will confirm receipt, keep you updated, and credit you if you would like us to.