Security

WorkTogethr is operated by Desisle. This page describes, plainly, how we protect the data in your workspace today. As the product matures we will expand these measures and update this page - we would rather under-promise than overstate.

Tenant isolation

Every agency workspace is logically isolated. All data is scoped to your agency at the database layer, and every API request is verified against your workspace membership and role before anything is returned. Clients see only their own projects and the material shared with them; client team members see delivery work only - never invoices, contracts or budgets.

Authentication & passwords

Sign-in uses secure, signed session tokens (JWT via NextAuth). Passwords are stored only as salted bcrypt hashes - never in plain text - and password resets use single-use, time-limited links. Role-based access control (owner, manager, team member, client, client team member) is enforced on the server for every request, not just hidden in the UI.

Two-factor sign-in

Anyone can turn on two-factor sign-in with an authenticator app (a six-digit code that changes every 30 seconds) from their profile. A workspace owner can make it compulsory for owners or for all staff. It is off by default and is never forced on an account before it has been set up.

Data in transit

All traffic to worktogethr.com is served over HTTPS/TLS.

Payments

Subscription payments are processed by Razorpay. Card details never touch our servers - we store only the subscription status and invoice records needed to run your account.

Uploads

File uploads are validated for type and size before being accepted. Files are kept in private storage - not in the database - and handed out through short-lived links, only to signed-in members of the owning workspace who may see that file. Credentials stored in a project's handover vault are encrypted.

What we don't claim

We do not currently hold SOC 2, ISO 27001 or similar certifications. If a page or email ever suggests otherwise, tell us and we'll correct it. Certifications are on our roadmap as the platform grows.

Reporting a vulnerability

Found something? Email contact@worktogethr.com with the details. We read every report and will respond as quickly as we can. Please avoid accessing data that isn't yours while demonstrating an issue.