Security and data protection, in plain terms.
Worksi AI Control sits between your applications and your model providers, so it is built to store as little as you choose, isolate every tenant, and record every change.
At a glance
- Not used to train models
- Worksi does not train models. LLM‑assisted diagnosis sends incident evidence to OpenAI, or to a credential you choose, and you can switch it off.
- AWS, single region
- The hosted service runs on Amazon Web Services in a single region.
- Secrets encrypted, keys hashed
- Provider keys and webhook secrets use AES‑256‑GCM. API keys and tokens are stored only as SHA‑256 hashes.
- Report a vulnerability
- How to report
Store full text, redacted text or no text at all.
Every environment has a capture mode. A client can make it stricter per request, never looser.
| Capture mode | What is stored | Use it for |
|---|---|---|
| Full | Input and output previews up to 2,000 characters; complete payloads over 16 KiB in object storage, kept 90 days | Development and staging with synthetic data |
| Redacted (default) | Previews after sensitive values are replaced with [REDACTED:TYPE] | Most production workloads |
| Metadata only | No previews: hashes, counts, tokens, cost, timings, status and error types | Regulated data and strict customer contracts |
- What redaction replaces
- Email addresses, phone numbers, payment card numbers (Luhn-checked), US social security numbers, IBANs (checksum-validated), IPv4 addresses, API keys (including OpenAI, Anthropic, AWS, GitHub, Slack and Worksi keys), JSON web tokens, bearer tokens and password fields. Error messages are redacted too.
- What it can’t catch
- Redaction is pattern-based: it does not detect names, postal addresses or free-text personal data. Use metadata-only capture for such workloads, send pseudonymous end‑user ids, and keep personal data out of agent, workflow and tool names, tags and attributes, which are stored as sent.
- Claude tool loops
- To continue a Claude tool loop, the gateway keeps that turn’s thinking blocks for 1 hour, whatever the capture mode. They are never written to traces or logs.
How the platform protects you.
- Tenant isolation
- Every database query is scoped to your organization; analytics queries bind the organization as a parameter.
- The organization, workspace and environment of telemetry always come from the API key, never from the client.
- Objects of another organization return “not found”.
- Access control
- Six roles (owner, admin, operator, developer, viewer, auditor), checked on every API endpoint.
- Only owners can grant ownership, and the last owner can’t be removed.
- Personal access tokens always carry the user’s current role.
- Four‑eyes: high‑risk actions need a second person, and nobody approves their own request.
- Credentials and secrets
- Passwords hashed with argon2id; brute‑force protection with rate limits and temporary account locks.
- Short-lived sessions with rotating refresh tokens; reuse of a revoked token revokes the whole session.
- API keys and tokens stored only as SHA‑256 hashes and shown once.
- Provider keys, their extra headers and webhook secrets encrypted with AES‑256‑GCM; the API only ever returns a hint or header names.
- Accountability
- Every change is written to the audit log in the same transaction: actor, action, before and after, IP.
- Audit entries are hash-chained per organization, and the database rejects edits and deletes.
- A verification check recomputes the chain and reports the first broken entry.
- Recovery actions appear on the incident timeline and are permission-checked.
- Network and outbound traffic
- HTTPS with strict security headers: content security policy, HSTS and framing protection.
- Outbound calls are refused for cloud metadata and link-local addresses, and for private networks and loopback unless an operator allows them for a provider; redirects are never followed.
- Webhooks are signed with HMAC‑SHA256 over a timestamp and the body.
- Internal service APIs are not reachable from the internet.
- Infrastructure
- Hosted on Amazon Web Services; databases in private subnets without an internet route.
- Encryption at rest with AWS KMS for databases, storage and backups; TLS to every data store.
- Platform secrets in AWS Secrets Manager; containers run as non-root users.
- Automated code, secret, dependency and container-image scanning in the delivery pipeline.
Kept only as long as your plan says.
Traces and their previews are deleted after your plan’s retention period, or sooner if you set a shorter period for your organization.
| Plan | Traces and previews are kept |
|---|---|
| Starter | 14 days |
| Pro and the trial | 30 days |
| Business | 90 days |
| Enterprise | Custom, 365 days or more |
| Audit log | Kept permanently, as a tamper-evident record. |
What reaches an AI model, and when.
Your application’s requests go only to the providers you configure, with your keys. Worksi itself calls a model for two features only.
- LLM‑assisted diagnosis
- Sends the incident’s evidence pack: the stored, capture‑mode‑filtered previews and metadata, never full payloads.
- Semantic search
- Embeds incident and runbook text to find similar incidents.
- Your controls
- They use the platform’s OpenAI key, or the OpenAI or OpenAI‑compatible credential you choose. Turn them off with the
diagnosis.llmandrunbooks.similarityfeature flags. Without a key, diagnosis stays deterministic.
Report a vulnerability.
If you find a security issue in Worksi AI Control, report it to us privately.
- Where
- info@xeoo.io
- What to include
- The affected component, the impact and the steps to reproduce.
- Ground rules
- Test only against organizations you own, never include other people’s data, and give us reasonable time to fix the issue before disclosure.
Security questions
More questions? Email info@xeoo.io.
Do you hold certifications such as SOC 2 or ISO 27001?
No, Worksi does not hold third-party security certifications today. This page describes the controls the product actually has. For a security review, email info@xeoo.io with your questionnaire.
Do you support single sign-on (SAML or OIDC) or SCIM?
No. Users sign in with an email address and password (argon2id-hashed, with brute-force protection), and organization owners manage members and roles in the console.
Is my data used to train AI models?
No. Worksi does not train models. When LLM‑assisted diagnosis is active, incident evidence is sent to OpenAI through its API to produce the diagnosis. You can send it to your own OpenAI or OpenAI‑compatible credential instead, such as a model you host, or switch the feature off.
Where is my data stored?
The hosted service runs on Amazon Web Services in a single region. Data leaves it only to reach the model providers, alert destinations and sub-processors described in the privacy policy.
Can you delete all of our data?
Yes. Organization owners can ask us to delete their organization; we delete its telemetry, stored payloads, exports and operational data. Audit events are kept as the permanent record, and backups expire on their schedule.
Choose what is stored, per environment.
Start in metadata‑only mode if you need to: hashes, tokens, cost, timings and errors, with no prompt text.
Keep readingAPI keysPoliciesGovernance
curl https://gateway.worksi.ai/v1/chat/completions \ -H "Authorization: Bearer $AIW_API_KEY" \ -H "X-AIW-Capture: metadata_only" \ -H "Content-Type: application/json" \ -d '{"model": "gpt-5-mini", "messages": [{"role": "user", "content": "Hi"}]}' # a client can only lower the capture level