For the complete site index, see llms.txt.
What protects your work today
Every control on this page is live in the product. Its current limits are listed at the end.
Your data
Hosted in the United States
Workprentice runs on Amazon Web Services in the United States.
Encrypted in transit and at rest
Connections use HTTPS with TLS 1.2 or newer. The database and file storage are encrypted at rest, and tokens for the accounts you connect are encrypted again by the application before they are stored.
Not used for training
We do not use your content to train or fine-tune AI models, and our AI providers may not either. The Privacy Policy states this, and the Subprocessors page lists every provider that processes your data.
What an agent can reach
Only what you connected
An agent works in the systems someone on your team connected, with the access that connection grants.
Commands run without stored credentials
Shell commands and Python that an agent runs execute in a separate container from the agent. That container stores no credentials. When a command needs one, such as a GitHub token, the token is placed in that command's environment for that command only, so the command itself can read it.
No private network addresses
Agent web requests are refused when they resolve to a private network address or a cloud metadata service.
Network destinationsEnterprise
Admins can limit the domains an agent may reach. Each session's outbound traffic goes through a proxy outside the agent that applies the limit, and the network drops connections that try to go around it.
Integration and command policiesEnterprise
Admins choose which integrations each agent may use and which classes of shell command it may run, at the organization, workspace, or agent level. A lower level can add restrictions but cannot lift one set above it.
People and access
Workspace roles
Each workspace member is an owner, admin, member, or viewer. An organization admin's role does not give them access to another member's private work.
Removing a member
Removing someone revokes their membership and the credentials tied to it. Their private work moves into custody, where an admin can transfer it or have it deleted without reading it.
Single sign-on
People sign in through your identity provider with SAML 2.0, for email domains you have proven by DNS. An owner can require it, which ends sign-in by emailed link, password, and Google for members. Owners keep an emailed link so a provider outage cannot lock the organization out, and every owner is told when one is used. Workspace API keys, agent tokens, and OAuth grants to outside applications are not covered by the requirement; each ends when its holder is removed.
Directory provisioningEnterprise
Your identity provider can decide who may join and remove people it deactivates, over SCIM 2.0, and place its groups into workspaces. A removal made this way revokes the same sessions and credentials as one an admin makes.
Our own access
Workprentice staff access to production follows least privilege: each person holds only the access their role needs, and uses it only to operate and support the service.
Oversight
Every step on the record
Each thought, tool call, and result lands in the session as it happens.
Guardian
On by default. Before an agent posts a message, pushes code, or opens a pull request, Guardian checks it for confidential information. Guardian is itself an AI model, so it can miss things, and if it is unavailable the work goes ahead.
Budgets
Give a session a budget and it pauses for your review when it reaches it. Budgets are optional, and calls already in flight can carry a session slightly past one.
Audit logEnterprise
Admins can search and export, as CSV or JSON Lines, a log of sign-ins, membership and role changes, each time an agent obtains a connected account's credential, and Guardian reviews.
Current limits
OpenID Connect sign-on
Single sign-on is SAML 2.0 only. Signing in through your identity provider with OIDC is not available.
SOC 2
We do not have a SOC 2 report or any other third-party attestation.
Data processing agreement
We have not published a DPA.
Retention and deletion controls
There are no settings for data retention or zero data retention, and no self-serve account deletion. We delete accounts on request.
Hosting region choice
You cannot choose where your data is hosted.
Request-level network control
The network limit checks only where a connection goes. An agent allowed to reach a domain can send that domain anything its session can read.
Prompt injection
Web pages, documents, and tool results can contain instructions meant to mislead an agent. Agents are told to treat that content as data, and the controls above limit what a misled agent can reach, but nothing prevents a model from being misled.
Contact
Report a vulnerability or ask a security question at security@workprentice.com. Our security.txt lists the same address. See also the Privacy Policy, Subprocessors, and Terms of Service.