Trust
Security and privacy
Your staff records, salaries and passwords are some of the most private things a company has. This is how WorkforceOS looks after them.
Your data stays yours
A private space per company
Every company's records are kept apart, and every page and report only reads your own company's data.
You choose who sees what
Roles decide who can see salaries, documents and approvals. Managers see their own team.
Take it with you
A Super Admin can download all of the company's data at any time, from the Billing page.
Signing in
Every account, every day.
Passwords never stored as text
Sign-in passwords are stored as one-way hashes (bcrypt), so nobody can read them, including us.
2-step sign-in
Anyone can add an authenticator app code to their sign-in. A company can require it for every admin.
Lockout after wrong tries
Five wrong passwords lock that account for 15 minutes, and the lock holds even if the server restarts.
Signed-in devices
Each person sees where their account is signed in and can sign out any device. Changing a password signs out the others.
Behind the scenes
Audit log
Sensitive actions such as role changes, vault use, 2-step sign-in changes, lockouts and data exports are recorded with who did it and when.
Checked uploads
Uploaded files are checked by their content, not their name, and programs are refused.
Nightly backups
The database is backed up every night and the last 30 backups are kept.
Monitoring only with consent
Desktop monitoring is off unless your company turns it on. Staff agree to it first, it only runs while they're clocked in, and screenshots can be blurred.
Found a security problem?
Please write to contact@workforceos.info with the subject "Security". We reply within one working day and fix confirmed problems as a priority. Please give us a chance to fix a problem before telling others about it.
Read the Privacy Policy for what data we keep and why.
New protections
Virus scan on uploads
Every uploaded file, including chat attachments, is scanned before it's stored.
Strict script rules
Pages only run the scripts we put there, which blocks a whole class of attacks.
Join links approved by admins
New staff can ask to join with a link, but nobody gets in until an admin approves them.
Custom roles
Give people only the admin tools they need, so fewer people can see salaries.
Free for 30 days
Try it with your own team
Free trial, no card needed. Questions first? Write to contact@workforceos.info.