How WorkBOS protects your workspace from attacks

WorkBOS watches the whole platform for attacks around the clock and stops the obvious ones on its own. You do not need to set anything up.

• Sign-in protection: every wrong password makes the next attempt slower to try, the account owner gets an email after repeated failures, and one address trying passwords on several accounts is blocked automatically.
• Robots and scanners: requests for the secret files that badly set-up websites leak (for example .env or .git) are recorded, and the address asking is blocked. We never had those files, so nothing is exposed.
• Stopped before they arrive: blocked addresses are turned away at our hosting provider’s network edge, before they reach WorkBOS, and so are floods of sign-in requests from one address. If you ever see a page saying your browser is being checked, that is this protection: it passes by itself in a normal browser within seconds. If it keeps failing, try another browser or network and tell support.
• Speed limits: sign-in, sign-up, password reset, public forms, bookings and our API all have limits, so a flood of requests is turned away instead of slowing everybody else down.
• Risky changes: when admin rights change, two-step sign-in is removed from an admin, or a workspace exports or deletes an unusually large amount of data in a short time, our team is alerted and so are your workspace’s owners and admins, in Administration ▸ Security centre.
• Passwords found in data breaches: WorkBOS refuses a password that is on public lists of passwords stolen from other websites wherever you choose one in WorkBOS, and tells you when you sign in if the one you use is on them. Your password is never sent anywhere to check it. See Passwords found in data breaches.
• Every download recorded: whenever someone downloads a list or a report as a CSV file, the activity log records who, what and how many rows, and a lot of downloading in a short time alerts your owners and admins. Files are built so a cell can never run as a spreadsheet formula when opened.
• Tested every day: WorkBOS tries to break into itself from the outside every six hours and runs a full security test every day, including a practice attack each week, and again whenever a real attack is noticed. If a defence stops working, our team is told straight away.