Security
How WorkOnations protects your business.
Your data is separated from every other business
Every read and write is scoped to your business. A record id from another account returns “not found”, so even its existence is not revealed. Tests check this for customers, quotes, jobs, invoices, leads and follow-ups.
Sign-in and sessions
Passwords are hashed with bcrypt. Session tokens are random, stored only as a keyed hash, and sent in an HttpOnly cookie. Repeated failed logins are locked for 15 minutes. Password reset links are single-use and expire after one hour.
Payments
Online card payments use Stripe Checkout. Card details go to Stripe, never to WorkOnations. An invoice is marked paid only after a signed Stripe webhook confirms the payment. A browser redirect alone never changes a balance.
Customer links
Quote, invoice and customer portal links use long random tokens, not numbers someone could guess. Drafts are never public. A customer portal link can be revoked at any time.
Web protection
In production, pages are sent with a content security policy, frame blocking and strict referrer rules. Forms are checked on the server. Public forms have spam protection and rate limits.
Services we use
No AI provider or paid API is required. Email goes through the SMTP server configured for the installation. Payment processing is Stripe. Records are stored in a PostgreSQL database, separated by business as described above.
What we do not claim
WorkOnations has not had an external penetration test yet. Anyone who has a quote or invoice link can open that one document. We will update this page as that changes.