Security

WorkTogethr is operated by Desisle. This page describes, plainly, how we protect the data in your workspace today. As the product matures we will expand these measures and update this page — we would rather under-promise than overstate.

Tenant isolation

Every agency workspace is logically isolated. All data is scoped to your agency at the database layer, and every API request is verified against your workspace membership and role before anything is returned. Clients see only their own projects and the material shared with them; client team members see delivery work only — never invoices, contracts or budgets.

Authentication & passwords

Sign-in uses secure, signed session tokens (JWT via NextAuth). Passwords are stored only as salted bcrypt hashes — never in plain text — and password resets use single-use, time-limited links. Role-based access control (owner, manager, team member, client, client team member) is enforced on the server for every request, not just hidden in the UI.

Data in transit

All traffic to worktogethr.com is served over HTTPS/TLS.

Payments

Subscription payments are processed by Razorpay. Card details never touch our servers — we store only the subscription status and invoice records needed to run your account.

Uploads

File uploads are validated for type and size before being accepted, and files are only served to signed-in members of the owning workspace.

What we don't claim

We do not currently hold SOC 2, ISO 27001 or similar certifications, and we have not yet shipped two-factor authentication. If a page or email ever suggests otherwise, tell us and we'll correct it. Certifications and 2FA are on our roadmap as the platform grows.

Reporting a vulnerability

Found something? Email contact@desisle.comwith the details. We read every report and will respond as quickly as we can. Please avoid accessing data that isn't yours while demonstrating an issue.