Security
Last updated 18 October 2026
You are trusting us with your members and your money. Here is how we look after both.
1. Every organisation is walled off
Each organisation’s members, bookings and payments carry its organisation ID, and the database itself enforces that a person can only read and change data for organisations they belong to. We run an automated isolation test of more than 40 checks before every database change reaches production.
2. Encryption
All traffic uses HTTPS (TLS). Data is encrypted at rest by our database and storage providers. Passwords are stored only as salted hashes.
3. Payments
Card payments are handled by Stripe, a PCI DSS Level 1 provider. Card numbers never touch Work This Way servers.
4. Access and auditing
Admin and platform actions are permission-checked on the server, not just hidden in the interface. Platform-level changes are recorded in an audit log. Staff access to customer data is limited to support and only when needed.
5. Files and uploads
Logos and floor plans are stored privately and served only through permission-checked routes.
6. Reporting a vulnerability
If you think you have found a security issue, please email security@workthisway.app. We will acknowledge your report and keep you updated while we fix it.