Security at wrkflow

Application

A Next.js application that runs in a container on one Amazon Lightsail server in Amazon Web Services’ Mumbai region, with Caddy in front of it handling HTTPS. There is one server and no standby; Operations says what that means.

Database and sign-in

Postgres for data, with Supabase’s open-source sign-in (Supabase Auth), data API, live updates and file service, run by us on the same server. Uploaded files are kept in Amazon S3. Passwords are hashed by the sign-in service and never stored in plain text.

One path to data

Browsers only hold a publishable key, and every query they make runs as the signed-in person under row-level security. Survey answers can’t be read that way at all: server code reads them only after checking the person’s organization and role, and applies masking, sensitive-answer and anonymity rules before anything is shown. The secret key never leaves server code.

Row-level security everywhere

Every table checks which organization a person belongs to, and their role, before any row is read or written. Someone outside an organization gets a “not found”, never a hint that it exists.

Roles enforced by the database

Owner, admin, editor and viewer permissions are policies in Postgres, so a bug in a page can’t widen access.

Tested on every change

Automated database tests assert the isolation and permission rules, and run on every pull request.

In transit

HTTPS only, with HTTP Strict Transport Security; the certificates come from Let’s Encrypt. Calls to the file store and to outside services such as email, payments and the AI assistant use TLS, and the file store refuses plain HTTP. Between the services on the server itself, traffic stays on the server’s private network.

At rest

Uploaded files and the nightly database backups are kept in a private Amazon S3 bucket with server-side encryption (AES-256). The live database runs on the server’s own disk, and wrkflow does not add disk encryption of its own there; answers to sensitive questions are encrypted by wrkflow itself, as described next.

Sensitive answersEnterprise

When this deployment has its encryption key set, answers to questions marked as sensitive are encrypted by wrkflow (AES-256-GCM, with separate keys for each organization) before they are stored, and shown only to the roles you choose. Without the key such questions can’t be used: wrkflow refuses rather than store the answer in plain text. The key is not set on this deployment, so sensitive questions are not switched on here.

Secrets

API keys, invitation links, shared report and dashboard links and provisioning tokens are stored only as SHA-256 hashes. Webhook signing secrets and SIEM tokens are kept where the API can’t read them and aren’t shown again after they’re set.

SAML single sign-onEnterprise

Okta, Microsoft Entra ID or any SAML 2.0 provider, connected by metadata, where the deployment has SAML switched on. For your verified domains, passwords are refused and sign-in goes through your provider. Owners keep a password so a misconfigured provider can’t lock you out.

SCIM provisioningEnterprise

Entra ID and Okta can add, update and remove people. Removing someone ends their sessions and takes them out of your organization; groups can map to roles.

Verified domainsEnterprise

Prove a domain with a DNS TXT record. A domain can belong to one organization only.

Two-factor authentication

Authenticator-app codes, checked on every page once set up. Password resets need the code too. Anyone can turn it on for their own account; requiring it for every member of an organization is part of the Team plan and above.

Sign in with Microsoft or Google

Available where a deployment turns them on, alongside email and password.

Passwords and sessions

At least 10 characters with upper and lowercase letters and a number. Email addresses are confirmed before an invitation can be accepted. Refresh tokens rotate.

Audit log

Membership, sign-in policies, provisioning, surveys, contacts, exports and deletions, with the person and the time. No member, whatever their role, can edit or delete entries. Exporting it is recorded too.

Streaming to your SIEMEnterprise

Send each new entry to Splunk (HTTP Event Collector), Datadog or any HTTPS endpoint, signed with HMAC-SHA256, with retries and a delivery log.

Exports on record

Every export of survey results is logged with its format.

Data residency

This deployment stores its data in India (Mumbai, AWS region ap-south-1): the database, uploaded files, backups and server logs. Each deployment is one region. The services listed under Subprocessors process what they receive in their own locations, which are not necessarily in India.

RetentionEnterprise

Delete responses automatically after 90 days to three years. The rule runs every night and is permanent in the live database; copies in nightly backups are deleted when those backups expire after 30 days.

Personal data requests

Find everything held about an email address, export it as JSON, or erase it. Requests are audited without storing the address.

Anonymous surveys

Responses are unlinked from people, times are kept to the day, and no group smaller than five is shown or exported.

Saved progress

When a survey lets people save and continue, their unfinished answers are kept on our servers for 30 days by default (each survey sets its own, from 1 to 365), then deleted. They are also deleted when the person submits, when the survey turns the feature off, and when a person’s data is erased. Answers to sensitive questions are never saved before submission, and an anonymous survey never ties unfinished answers to a person.

Data processing agreement

Owners can request a DPA from their organization’s settings, or ask with the form below.

Backups

A full copy of the database goes to a private, encrypted Amazon S3 bucket every night and is kept for 30 days. Lightsail also takes a daily snapshot of the whole server. Uploaded files live in the same bucket with versioning on, so an overwritten or deleted file can be recovered for 30 days; they are not part of the database copy. We have not yet rehearsed a restore from these backups.

Recovery and uptime

wrkflow runs on one server with no standby and no second region, and there is no uptime guarantee. New versions are swapped in without taking the site down. If the server fails, we restore the latest backup onto a new one, and up to a day of recent changes could be lost.

Logs

What the services on the server print (the application, sign-in, database and web server among them) goes to Amazon CloudWatch in Mumbai and is kept for 30 days. Lines can include email addresses, for example in sign-in errors.

Abuse limits

Public survey submissions, poll votes, the API and provisioning are rate limited.

Browser protections

Only survey pages can be embedded in other sites; every other page refuses framing. Pages refuse MIME sniffing. A Content-Security-Policy is sent in report-only mode, which blocks nothing yet; enforcing it is a setting.

Certifications

wrkflow doesn’t hold a SOC 2 report or an ISO 27001 certificate today. We answer security questionnaires and share our documentation on request, and this page describes the controls as they are built.