Security
Last updated: October 2026
Oworking takes the security and privacy of participant data seriously. This page describes our security practices, data handling principles, and how to report vulnerabilities.
Data architecture
- Contact information is architecturally separated from company profile data
- Contact details are only surfaced when bilateral consent has been confirmed
- Passwords are hashed using industry-standard algorithms; plain-text passwords are never stored
Application security
- Signed session tokens, checked against the account every few minutes and revoked when the password changes
- SameSite session cookies and CSRF tokens on sign-in
- SQL injection prevention via parameterized queries (Prisma ORM)
- XSS prevention via React's default output encoding
- Role-based access control: participants cannot access admin endpoints
- Rate limiting on sign-in, per address and per account, and on the API
- Content-Security-Policy headers
Data access and retention
- Platform staff access to participant data is limited to support and operational necessity
- AI providers receive only the context needed for each analysis, never contact details
- Account deletion requests result in anonymization or deletion of personal data
- Changes to roles, plans and platform modules are recorded in an audit log
Responsible disclosure
If you discover a security vulnerability in the Oworking platform, please report it responsibly to support@oworking.com.br with subject line "Security Vulnerability Report". Please do not publicly disclose the vulnerability until we have had a reasonable opportunity to investigate and remediate. We will acknowledge receipt.
Next steps
- Independent penetration test
- Automated secrets scanning and dependency audit on every change
- Backup and recovery drill