How we protect
the evidence we hold.
WorkTrack HQ stores something sensitive: a record of how your team works. We treat it accordingly. This page is the standing record of our security posture — written for the people who actually have to read it.
We’ll be straight with you: WorkTrack HQ holds no SOC 2 report, no GDPR certification and no formal compliance attestation of any kind. No audit is under way, and we are not going to describe one as imminent to make the absence sound temporary. This page describes the controls we run right now — not badges we haven’t earned.
Encryption where we actually apply it
HTTPS for everything in transit. Passwords are scrypt-hashed with a per-account random salt; session tokens are stored as hashes, in HttpOnly cookies. OAuth tokens for Google, ClickUp and GitHub are sealed with AES-256-GCM, from a dedicated key that is no provider’s client secret, before they touch the database — and are never returned by an API route or written to a log. We do not claim per-workspace encryption keys or a key-rotation cycle for evidence storage, because we do not run one.
Per-workspace data isolation
Workspace data is scoped to its workspace: every list, report and evidence read resolves the acting member’s organization first and answers only from within it. This is application-level scoping enforced in the domain layer — not database row-level security, and we would rather name the mechanism than imply a stronger one.
Screenshot retention, on a schedule
Retention is a per-workspace window, and it is 30 days by default; an enterprise customer may be given a longer one by agreement. A scheduled job runs every half hour and deletes expired captures — the row, the stored image and the thumbnail — and an owner or admin can also run it on demand. It applies forward only: each workspace has a retention floor, the moment automatic purging was switched on for it, and nothing captured before that is deleted by retention at any window, on the schedule or on demand. No automated way to remove those exists today; the request is answered by hand. The schedule never touches the raw activity records that daily hours are computed from. Separately, the API stops serving a screenshot image older than 90 days; that is a read cut-off, not a deletion.
Role-based access controls
Four built-in roles — Owner, Admin, Manager, Member. There are no custom roles. A manager sees only the members and projects their scope grants, a blanket project grant never exposes owners, admins or fellow managers, and per project the grant can be narrowed to a score instead of the underlying evidence.
Evidence the member owns
A member sees their own record, and no setting turns that off. They can delete their own capture until a reviewer approves it, and remove any ten-minute window of their day outright — records and stored image files both. A reviewer deleting someone else’s capture is a different, appealable act that leaves a recorded deduction.
Audit logs that are actually audited
Every admin action — interval changes, deletions, role assignments, exports, integrations — leaves a record naming who did it and when, and the record outlives the thing it describes. There is no plan-tiered log retention and no automatic expiry: entries are kept.
Three jurisdictions, named
There is no data-residency choice, and we will not advertise one we cannot honour. The company that operates WorkTrack HQ is registered in Pakistan; the API and PostgreSQL database run in one AWS region, ap-southeast-1 (Singapore); screenshots, attachments and voice-note audio sit in one Cloudflare R2 bucket in the United States. That is three countries’ laws touching one work record, and the Privacy Policy says so in its second paragraph rather than its appendix.
What we do not have
No SOC 2 report, no ISO 27001 certificate, no HIPAA attestation, no GDPR certification. No third party has audited these controls. No on-call rotation, no contractual breach-disclosure SLA, and no SAML SSO or SCIM provisioning — none of it exists in the software today. If any of these is a requirement for you, the answer is no, not "coming soon".
Found something? Tell us first.
Report it to us and we will fix it. Researchers acting in good faith — no data exfiltration, no service degradation, no third-party data touched — will not be pursued by us. We are a small team and will not promise an acknowledgement clock or a fix deadline we have nobody rostered to meet.
Severity, in the order we will drop other work for it. There is no bounty programme, and no payment for a report. We are not going to imply one with a severity table: this is what we will do with your finding, not what we will pay for it.
Have a security question,
or want to talk through our posture?
Drop us a note. A real engineer reads the inbox.