Trust center
How we protect your business data, how the staff use AI, and what we don't do yet. In plain words.
How your data is protected
Each company walled off
Every company's data is separated by the database itself (row-level security), as well as by our code. The app connects with a role that cannot bypass it, and our tests check every table.
Secrets encrypted
Store connections and other secrets are encrypted with AES-256-GCM. Passwords are stored only as one-way hashes.
Encrypted in transit
All traffic uses TLS, with strict transport security and a content security policy in production.
Abuse limits
Sign-in, sign-up, uploads and questions to the staff are rate limited.
Audit trail
Approvals, rule changes, connections and cost updates are recorded with who did it and when. Chat text is never written to the audit log.
People approve the money
The staff never place orders or make payments. Changes to your records, like a cost update in Shopify, happen only when a person presses the button.
Rules enforced by code
Spending caps, stock floors and ceilings, no-reorder lists and blackout dates are checked by our code before anything reaches you, and again when you approve.
Least data needed
From Shopify we read products, stock, orders and costs. We do not request your customers' names, emails or addresses.
How the staff use AI
Language models help the staff understand you and word their answers. They are never the source of a number.
Numbers come from your data
Forecasts and figures are calculated by our code from your store. Before an answer is shown, every number in it is checked against the data the colleague looked up.
Only what's needed is sent
A model sees the question and the short summary it's wording, not your whole store. Chart points and table rows are never sent.
Your data trains nothing for others
Cathy's specialist training uses data purchased from Shopify stores that are not wurkkin customers. Your business data is not used to train models for other companies without your explicit permission.
Who we share with
The providers who process data for us, and what they see.
| Provider | What for | Notes |
|---|---|---|
| Shopify | Your store's products, stock, orders, costs and discounts | Only when you connect it |
| OpenAI | Questions, short answer summaries, file headers and samples, document text for search | When AI features are on; not used to train their models |
| Stripe | Billing and payments | Card details go to Stripe, never to us |
| Cloud hosting and storage | The app, database and files | Encrypted at rest and in transit |
What we don't have yet
We'd rather tell you than have you find out.
- Single sign-on (SSO) is not available yet. Each person signs in with their own email and password.
- We have not completed a SOC 2 or ISO 27001 audit yet.
- A signed data processing agreement is available on request.
Report a security issue
Found something? Email info@wurkkin.com with the details and how to reproduce it. We'll reply within two working days, keep you updated while we fix it, and won't take action against good faith research that avoids harming customers or their data.
More detail: Privacy Policy and Terms.