Workspace369 holds client records, invoices, messages and signed documents for small businesses. This page says what we do to protect them, what we do not claim, and how to report a problem.
Hosting. Workspace369 runs on Google Cloud and Firebase, in the United States (database in South Carolina, application servers mostly in Iowa). Some AI requests may be served by Google's global endpoint, as our AI page explains. Google encrypts stored data at rest and traffic to and from our services uses HTTPS (TLS).
Payments. Card payments are processed by Stripe. We do not store full card numbers.
Sign-in and access. Phone-based multi-factor authentication is on by default, and the account holder can turn it off in account security settings. Roles (owner, admin, manager, member, viewer and custom roles) and per-screen permissions control who sees what. Contractors can be limited to the clients assigned to them. Our database access rules are written to deny anything not explicitly allowed.
Your data. The workspace owner can export the workspace and delete it. An export link works for 24 hours. A workspace deletion runs after a 24-hour grace period, and the owner can cancel before it ends. Some records are kept longer where the law or a contract needs it; for example sealed e-signature evidence is kept for its configured retention period (see the Privacy Policy).
Documents and signatures. Each signing event is chained to the one before it with SHA-256 hashes, so a changed record shows. Completed documents get a tamper-evident digital seal. Signing keys are held in a hardware-backed key service.
Inbound mail and files. Incoming email is checked for sender authentication (SPF, DKIM, DMARC), phishing and look-alike domains, and attachments are scanned for malware on Specialist, Commander and Enterprise plans. These are automated checks, not a guarantee.
Secrets. Service credentials are kept in Google Secret Manager, not in the app.
People. Access to production systems is limited to the founders and authorised contractors who need it, through Google Cloud access controls.
If we confirm that personal data in your account was accessed or disclosed without authorization, we notify affected customers without undue delay, within 72 hours of confirming it for business customers (as stated in our DPA), and within the deadlines that apply by law, and we tell you what happened, what data was involved and what to do. Florida law, for example, sets a 30-day outer limit for notices to individuals. Where we process data on behalf of a business customer, we tell that customer promptly so they can meet their own duties.
If you think you found a security problem in Workspace369, please tell us first.
When you test, please:
If you follow these rules and act in good faith, we will not take legal action against you for your research, and we will work with you to fix the problem. We do not currently run a paid bug bounty, but we are glad to credit you if you wish.
Privacy Policy · Terms of Service · Trust · How we use AI · Copyright policy · Sub-processors