Security at Worknize

Website safeguards

• HTTPS-focused browser protections, including strict transport, content-type, framing, referrer, and permissions policies.
• A content security policy that limits the sources the website can load.
• Validation, request-size limits, origin checks, timeouts, and abuse controls on the demo enquiry endpoint.

Product access

Worknize separates administrator and employee experiences and is designed to require authenticated access to product data. Security controls can change as the product evolves, so organisations should request the current control details that matter to their review.

Normal and Incognito chat

Normal is the default, company-managed chat. Authorised company administrators and managers may review Normal conversations within their permitted company or team scope, including conversations they do not participate in. Normal chat is not participant-only end-to-end encrypted messaging.

Incognito is a separate, end-to-end encrypted mode granted individually by an administrator. Conversation participants can decrypt its content. Administrator privileges alone do not give decryption access; an administrator who is a participant can read that conversation. Confirm supported devices and the access policy for your rollout before relying on Incognito.

Encryption does not prevent a participant from copying or sharing a message, and it does not protect content on a compromised device. No system can guarantee protection against every attack.

Shared responsibility

• Use unique credentials and protect access to your email and devices.
• Review who has administrative access when staff roles change.
• Do not submit passwords, identity documents, payroll files, or other sensitive personal data through the public demo form.

Security questions

For a security review or to report a suspected issue, use the contact form and write “Security review” in the message. Do not include exploit code, credentials, or personal data in the first message; the team can arrange an appropriate follow-up channel.