Security and privacy

Hosted in the EU

WORK³ runs on servers in the EU (Hetzner, Helsinki), operated by NOD³ in Sweden. Files are stored encrypted, in the EU.

Your workspace is kept apart

Every workspace’s data is isolated in the database itself, not only in the application. Each request runs as the signed-in person in their workspace, and the database refuses to return rows from any other workspace. Automated tests check this isolation on every change.

Sign-in

• No passwords to leak: Google, one-time email codes or passkeys.
• Email codes are valid for 10 minutes, work once, and lock after five wrong tries.
• Sessions are kept in secure, http-only cookies and expire after 30 days without use. You can see and sign out every device under Passkeys and devices.

Encryption

• All traffic uses HTTPS.
• Files, integration keys and secrets are encrypted at rest.
• API keys are shown once; only a hash is stored.

Who can see your content

• People in your workspace, according to their role.
• Expert partners you add, with the role you choose.
• WORK³ staff see only metadata (such as workspace name, plan and member count). Content requires support access that an owner approves, and it ends by itself.

Everything above shows in your audit log.

Personal data

We store as little as we can about people: name, email, photo if you add one, and what you do in WORK³. Your clients’ contacts stay in your CRM; WORK³ only keeps a reference to them. You choose how long the audit log keeps entries.

Legal

Our privacy policy, terms of service, data processing agreement, subprocessors and cookies have the details. In WORK³ you find them under Privacy & terms in the menu behind your picture, on the sign-in page and at the bottom of every email.