Security & Data Protection

1Overview#

WorkNivo Intake processes purchase-order documents that can contain confidential business information and Personal Data. We design the Services so that each Customer's data is kept separate, access depends on a person's role, secrets stay on the server, and nothing leaves the review process as an approved order without a person deciding so.

No set of measures makes a system completely secure, and we do not say that WorkNivo is. This page tells you what we do so that you can judge whether it is right for your data. Where something is not in place, we say so in What we do not claim.

2Workspace separation#

Every Customer works in its own Workspace. Separation is enforced by the database itself, not only by the application screens:

• Row-level security is switched on for every table that the application can reach. A database request only returns rows that belong to a Workspace the signed-in person is a member of.
• Changes to records go through database functions that check the person's membership and role before they write anything. Default database privileges are removed, so a table cannot be read or changed unless access was granted on purpose.
• Uploaded files are stored under their Workspace's own folder, and the storage rules check that folder on every request.

3Access and roles#

Inside a Workspace, each Authorized User has one of three roles: owner, manager or member. The role decides what the person can do, and the database checks it on every action.

• Only Workspace Owners can change roles. The last owner of a Workspace cannot be demoted and cannot leave, so a Workspace always has an owner.
• Owners and managers can invite people. An invitation is for a specific email address and role, can be used once, expires after 7 days, and can only be accepted by someone signed in with that email address. WorkNivo does not email invitations: the inviter shares the link, so it should only be shared with the person invited.
• Removing a member ends their access to the Workspace. The records they created, such as uploads and approvals, stay in the Workspace as part of its history.

WorkNivo staff with platform-administrator rights use a separate administration area. Platform-administrator rights are granted only directly in the database, not from the application. The code requires these accounts to use multi-factor authentication in production. The administration functions cannot read a Workspace's documents or orders, and every administrator action is recorded in an append-only log that also appears in the affected Workspace's activity history, labelled "WorkNivo".

The person who runs WorkNivo's hosting accounts can technically reach all stored data through the hosting provider's own administration tools, which are not limited by the controls above. We use that access only [To be confirmed: written staff-access policy: when staff may access Customer Content and how that access is recorded].

4Signing in#

You can sign in with an email address and password, or with Google. What is in place today:

• WorkNivo's sign-up and password forms require passwords of 10 to 72 characters; whether our authentication provider enforces the same minimum on its own is not yet confirmed. A strength meter gives advice while you choose one. Passwords are handled by our authentication provider (Supabase Auth); WorkNivo's own code does not store them.
• A new email-and-password account must confirm its email address before it can be used.
• Passwords can only be changed through a reset link sent by email. A short-lived browser cookie (15 minutes) checks that the change comes from that link.
• Google sign-in is handled by Google and our authentication provider. WorkNivo never sees your Google password. See the Privacy Policy for what Google shares with us.
• Signing in keeps you signed in on that browser until you sign out. The cookies involved are described in the Cookie Policy.

5How uploaded documents are stored#

• Uploaded Documents are stored in a private storage area that is not reachable from the public internet without permission. The storage, database and authentication service are hosted by Supabase in the EU (Ireland).
• When you open a document in WorkNivo, it is shown through a signed link that expires after 60 seconds.
• Only PDF files of up to 20 MB are accepted. Before a file is processed we check that it really is a PDF and, where the page count can be read from the file, count its pages; documents over the page limit are then refused before they reach the AI Provider.
• A fingerprint (SHA-256 hash) of each file is calculated when it is uploaded and checked again on the server before the file is sent for processing, so a file that changed after upload is not processed. The same fingerprint stops the same file from being registered or processed twice in one Workspace.

Files are not scanned for viruses or malware. Some WorkNivo server functions run outside the EU; see Subprocessors for where each provider processes data.

We do not currently make a statement about encryption of stored data (encryption at rest): [To be confirmed: whether encryption at rest can be confirmed from Supabase's own documentation or contract for WorkNivo's plan].

6Encryption in transit and browser protections#

• WorkNivo is served over HTTPS. Browsers are told to use HTTPS only (HTTP Strict Transport Security, for two years, with preload).
• A Content Security Policy limits the page to loading code and data from WorkNivo itself and from our database provider. Other sites cannot show WorkNivo inside a frame.
• Further browser headers stop content-type guessing, limit what referrer information is sent, switch off browser features we do not use, and isolate WorkNivo's windows from other sites.
• The document-processing service only accepts requests from WorkNivo's own web addresses, the website assistant only answers requests from WorkNivo's own pages, and sign-in redirects only go to WorkNivo addresses.

We do not offer end-to-end encryption: WorkNivo's servers and our providers need to read documents to process them.

7AI processing#

To read a purchase order, WorkNivo sends the whole PDF to our AI Provider, Anthropic, from a server function, together with fixed instructions. This happens before anyone reviews the result, and the AI Provider may process it outside the EU. The security-relevant points are:

• Your customer, product and price lists, the uploader's identity and the Workspace name are not sent. Matching against your records happens afterwards, in WorkNivo's own code.
• The instructions tell the model to treat the document's text as data, not as instructions, to reduce the risk that text hidden in a document changes what the model does. This lowers the risk but cannot rule it out.
• The model's answer must fit a fixed structure and is checked before it is stored. An answer that does not fit is rejected and the processing job fails.
• WorkNivo does not log document contents and does not keep the AI Provider's raw response. It keeps the structured fields, a short excerpt of the source text for each order line, the model name and the amount of processing used.
• Limits on the number of processing attempts per document, per Workspace and in total protect the service against misuse and runaway costs.

What the AI Provider keeps, for how long, whether it may use the data for training, and where it processes it are explained in the Privacy Policy. What the AI can get wrong and the checks WorkNivo adds are explained in the AI Use & Responsibility Policy.

8Human approval#

An AI Draft never becomes an approved order on its own. The rules below are enforced in the database, so they cannot be bypassed from the screen:

• An order cannot be approved while any issue marked as an error is unresolved, or unless it has a customer, at least one line and totals.
• The order's integrity and the Workspace's business rules are checked again at the moment of approval.
• Where a Workspace uses multi-stage approval, each stage must be approved by a different person. A Workspace Owner may skip a stage that a business rule added, and the skip is recorded with a note.
• An order can only be exported after Approval. Exports are files downloaded to your own device; WorkNivo does not send orders to other systems.

These controls make sure a person decides. They do not make the decision correct: Approval means an Authorized User accepted the draft, not that it is free of errors. See Human review.

9Activity history#

Each Workspace has an activity history that records uploads, edits to orders (including the value before the change), approvals, rejections, exports and actions by WorkNivo staff, with who did it and when.

The history is append-only: the application cannot change or delete entries. If a user's account is deleted, their entries stay but no longer name them.

10Secrets and infrastructure#

• The keys that give full database access and access to the AI Provider are kept only in our hosting providers' server-side secret settings. They are never sent to your browser.
• Server functions that use full database access and act for a person first check, with that person's own credentials, that they may access the record concerned. The one function that receives no request from a person, the billing webhook, is instead authenticated by the payment provider's signature; payments are not live, so it receives nothing today.
• Rate limits apply to the website assistant, feedback messages, document processing and pilot requests, to reduce abuse.

Backups and recovery: [To be confirmed: backup frequency, how long backups are kept, and whether a restore has been tested]. We do not publish a recovery-time or recovery-point commitment.

11Service providers#

WorkNivo runs on a small number of providers: Supabase (database, sign-in, file storage and server functions), Netlify (website and web application), Anthropic (AI Provider), Resend (internal notification emails) and Cloudflare (domain name system and email forwarding). The full list, what each one does, where it processes data and the transfer safeguards are on the Subprocessors page.

We choose providers that publish their own security and data-processing terms. Whether each provider's data processing agreement is in force for WorkNivo's accounts is [To be confirmed: confirmed per provider from each provider's account dashboard]. How we tell business customers about new subprocessors is set out in the Subprocessors page.

12Security incidents#

If we become aware of a Security Incident, we will work to contain it, find out what happened and which data and Workspaces are affected, fix the cause, and keep a record of the incident and what we did.

If the incident is a Personal Data Breach:

• Where we process the data for a business customer (its Customer Content), we will inform the affected Workspace Owners without undue delay after becoming aware of it, and give them the information we have to help them meet their own obligations. The binding commitment, including any time limit, is in the Data Processing Agreement: [To be confirmed: breach-notice commitment to customers and the incident owner, once operations can support it].
• Where we are the controller (for example account details or website-assistant data), we will notify the competent data-protection authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to people. If it is likely to result in a high risk to people, we will also tell them without undue delay. The authority is named in the Legal Notice.

Our written incident-response procedure and breach register are [Planned: incident-response runbook and breach register (gap report O19)].

Anthropic's published Data Processing Addendum commits it to tell its customers about personal data breaches within 48 hours; whether that addendum is in force for WorkNivo's account is still being confirmed. [To be confirmed: that Anthropic's DPA, and its breach-notice commitment, apply to WorkNivo's account] Notice to you also depends on how quickly our providers inform us.

13Retention and deletion#

How long each type of data is kept is set out in one place, the retention table in the Privacy Policy. In short, from a security point of view:

• Uploaded Documents and order records are kept while the Customer's agreement runs and, after it ends, for the retrieval period in the Terms; WorkNivo then deletes them by hand. Nothing deletes them automatically today.
• Deletion of an account, a Workspace or its documents is carried out by hand, on request. [Planned: deletion tool that also removes stored PDFs, and the deletion timeframe (gap report O2); requests can already be sent from Settings].
• Deleted data can remain in backups until those backups expire: [To be confirmed: backup retention period].

Exporting your data and what happens when a contract ends are covered in the Terms of Service.

14What we do not claim#

So that there is no misunderstanding, WorkNivo does not have, and does not claim:

• any security or compliance certification (for example ISO 27001 or a SOC 2 report);
• an independent penetration test or independent security review;
• a guaranteed uptime or availability figure;
• end-to-end encryption;
• virus or malware scanning of uploaded files, or a web application firewall;
• multi-factor authentication, leaked-password checks or a CAPTCHA for customer accounts;
• a tested backup restore or a published recovery time;
• that WorkNivo cannot be breached or that the AI cannot be misled.

If any of this changes we will update this page. [To be confirmed: whether an independent security review will be commissioned before real confidential customer data is processed, and how to describe it].

15Report a vulnerability#

If you think you have found a security vulnerability in WorkNivo, or you suspect that someone has accessed your account or Workspace without permission, please email support@worknivo.app with "Security" in the subject line. [To be confirmed: dedicated security contact address (until then, support@worknivo.app)].

Please include what you found, where (the page or address), the steps to reproduce it, and how we can reach you. We will confirm that we received your report and keep you informed while we look into it.

When testing, please:

• only use accounts and Workspaces you own or are allowed to use;
• do not access, change or delete other people's data; if you reach any by accident, stop, do not keep a copy, and tell us;
• do not run tests that could disrupt the service, such as denial-of-service, spam or high-volume automated requests, and do not use social engineering against our staff or customers;
• give us a reasonable time to fix the problem before you tell anyone else about it.

We do not run a paid bug-bounty programme. [To be confirmed: whether to state a good-faith research (safe-harbour) commitment, and its wording].

Security reports

[To be confirmed: dedicated security contact address] General contact meanwhile: support@worknivo.app