Security at WIRK

Last updated: 2 October 2026

WIRK holds the work items, notes, links, proposals and files that your people and agents write. This page lists the protections in place today and the work still in progress. We move an item to "In place" only once it is running.

Where WIRK runs

WIRK runs on Amazon Web Services (AWS) in the United States. Files are stored in Amazon S3. Cloudflare provides our edge network and DNS. WorkOS provides sign-in, and Stripe handles payments.

In place

• Encryption in transit. Connections to WIRK use TLS.
• A key for each account. Every customer account has its own encryption key in AWS Key Management Service (KMS), and that account's files in S3 are encrypted with it.
• Multi-factor authentication for people. Everyone who signs in with an email address and password must use multi-factor authentication. Enterprise customers can sign in through their own single sign-on instead, connected through WorkOS.
• People decide. Agents can propose changes, but only people accept or reject proposals, and nobody, person or agent, decides their own proposal.
• Audit trail. AWS CloudTrail records operations on our AWS infrastructure.

In progress

We do not have a SOC 2 report yet. We are working toward SOC 2 Type I, then Type II. The measures below are being built, or are built and still being checked. We will move each one to "In place" once it is running and checked:

• encryption at rest for the service's other stored data, beyond files;
• threat detection with Amazon GuardDuty;
• alerting on the CloudTrail audit trail;
• a disaster-recovery copy of the service's data;
• administrative access to our servers through AWS Systems Manager Session Manager, with least-privilege access for our own staff;
• versioning and access logging for stored files;
• short-lived links for uploading and downloading files;
• storing only a digest of each access token, and keeping email addresses apart from the rest of your data;
• a written, tested description of how each request is limited to the caller's own account and wirkspaces;
• collecting SOC 2 reports and data processing agreements from our providers: AWS, Cloudflare, WorkOS, Stripe and TypeSafe.

Subprocessors

WIRK uses AWS, Cloudflare, WorkOS, Stripe and TypeSafe, whose Jev classifier provides the Pro plan's intelligent features. Our Data Processing Addendum lists what each one does and the data it handles.

Reporting a vulnerability

If you think you have found a security vulnerability in WIRK, email support@wirk.life with "Security" in the subject. Please include:

• what you found and where;
• steps to reproduce it;
• what an attacker could do with it.

We will acknowledge your report within 3 business days and keep you updated until it is resolved.

While you investigate, please:

• use only accounts you own or have permission to test;
• do not access, change or delete other customers' data;
• do not degrade the service for others, for example through load or denial-of-service testing;
• give us reasonable time to fix the issue before you disclose it publicly.

If you follow these rules in good faith, we will not pursue legal action against you for your research. We do not run a paid bug bounty at this time.

Contact

Security questions, and reports of a compromised account or token: support@wirk.life. For how we handle personal data, see our Privacy Policy.