Security at wrkflow

Application

A Next.js application hosted on Vercel. There is no separate API server and no custom infrastructure to patch.

Database and sign-in

Supabase: Postgres for data, Supabase Auth for accounts and sessions, Storage for files. Passwords are hashed by Supabase Auth and never stored in plain text.

One path to data

Browsers only hold a publishable key, and every query they make runs as the signed-in person under row-level security. Survey answers can’t be read that way at all: server code reads them only after checking the person’s organization and role, and applies masking, sensitive-answer and anonymity rules before anything is shown. The secret key never leaves server code.

Row-level security everywhere

Every table checks which organization a person belongs to, and their role, before any row is read or written. Someone outside an organization gets a “not found”, never a hint that it exists.

Roles enforced by the database

Owner, admin, editor and viewer permissions are policies in Postgres, so a bug in a page can’t widen access.

Tested on every change

Automated database tests assert the isolation and permission rules, and run on every pull request.

In transit

HTTPS only, with HTTP Strict Transport Security. Connections to the database, email and payment providers use TLS.

At rest

Supabase encrypts the database, its backups and stored files at rest (AES-256).

Sensitive answers

Answers to questions marked as sensitive can be encrypted at the field level, on top of disk encryption, and shown only to the roles you choose.

Secrets

API keys, invitation links, shared report and dashboard links and provisioning tokens are stored only as SHA-256 hashes. Webhook signing secrets and SIEM tokens are kept where the API can’t read them and aren’t shown again after they’re set.

SAML single sign-onEnterprise

Okta, Microsoft Entra ID or any SAML 2.0 provider, connected by metadata. For your verified domains, passwords are refused and sign-in goes through your provider. Owners keep a password so a misconfigured provider can’t lock you out.

SCIM provisioningEnterprise

Entra ID and Okta can add, update and remove people. Removing someone ends their sessions and takes them out of your organization; groups can map to roles.

Verified domainsEnterprise

Prove a domain with a DNS TXT record. A domain can belong to one organization only.

Two-factor authenticationTeam

Authenticator-app codes, checked on every page once set up. Password resets need the code too. Organizations can require two-factor for every member.

Sign in with Microsoft or Google

Available where a deployment turns them on, alongside email and password.

Passwords and sessions

At least 10 characters with upper and lowercase letters and a number. Email addresses are confirmed before an invitation can be accepted. Refresh tokens rotate.

Audit log

Membership, sign-in policies, provisioning, surveys, contacts, exports and deletions, with the person and the time. Entries can’t be edited or deleted. Exporting it is recorded too.

Streaming to your SIEMEnterprise

Send each new entry to Splunk (HTTP Event Collector), Datadog or any HTTPS endpoint, signed with HMAC-SHA256, with retries and a delivery log.

Exports on record

Every export of survey results is logged with its format.

Data residency

Each wrkflow deployment stores its data in one region, shown in each organization’s settings. Ask us which regions are available.

RetentionEnterprise

Delete responses automatically after 90 days to three years. The rule runs every night and is permanent.

Personal data requests

Find everything held about an email address, export it as JSON, or erase it. Requests are audited without storing the address.

Anonymous surveys

Responses are unlinked from people, times are kept to the day, and no group smaller than five is shown or exported.

Saved progress

When a survey lets people save and continue, their unfinished answers are kept on our servers for 30 days by default (each survey sets its own, from 1 to 365), then deleted. They are also deleted when the person submits, when the survey turns the feature off, and when a person’s data is erased. Answers to sensitive questions are never saved before submission, and an anonymous survey never ties unfinished answers to a person.

Data processing agreement

Owners can request a DPA from their organization’s settings, or ask with the form below.

Backups

The database is backed up daily by Supabase. Our go-live checklist requires point-in-time recovery and a rehearsed restore, repeated every quarter. Uploaded files live in Supabase Storage, outside database backups.

Abuse limits

Public survey submissions, poll votes, the API and provisioning are rate limited.

Browser protections

Only survey pages can be embedded in other sites; every other page refuses framing. Pages refuse MIME sniffing and report Content-Security-Policy violations, with enforcement available.

Certifications

wrkflow doesn’t hold a SOC 2 report or an ISO 27001 certificate today. We answer security questionnaires and share our documentation on request, and this page describes the controls as they are built.