A security score with a to-do list, alerts in plain words, every device signed in, a full before-and-after activity log, an encrypted vault for keys, and consent records for the people you employ.
Free for up to 5 users. Pro free for 30 days. No card.
Why this exists
What it does
Administration > Security centre scores the workspace out of 100 and lists what would raise it, most important first: owners and admins without two-step sign-in, open alerts, people who have not signed in for 90 days, unused or old API keys and invitations left waiting.
Password guessing on a member’s account, somebody made an owner or admin, two-step sign-in switched off, very large exports or deletions, and an API key working far harder than usual. Owners and admins are told, by email for high and critical alerts.
Every member with the devices they have used, the country and when, and a sign-out-everywhere button for a lost laptop that also disconnects any AI assistant they connected.
Every screen where a password is chosen refuses one found on public lists of passwords stolen from other websites, and the Security centre names anyone who signed in with one.
Creates, changes and deletions are recorded with the full before-and-after, searchable inside the values and exportable. It always says who: a person, an integration by name, a public form, or the system. Nobody can edit or delete it, owners included.
Secrets & Keys stores API keys, client secrets and tokens encrypted, never shows a value back, reminds owners before a rotation date, and logs every create, change, reveal and delete.
Workforce privacy lists the ten things WorkBOS records about your people and, from the country each person works in, whether the law treats each one as a notice or a permission. It keeps the exact words each person saw.
The honest part
The part you would otherwise find out in week three. If one of these is central to how you work, raise it before you buy rather than after.
Questions
No. Nobody can edit or delete it, including workspace owners, and that is enforced by the database rather than by the screen.
An owner or admin opens that person in the Security centre and signs them out everywhere. Any AI assistant they connected is disconnected too, and they are emailed that it happened.
No. Knowing who can get in, and closing the doors a workspace left open, does not depend on the plan. The activity log and the keys vault are on higher plans.
The full product documentation for this module is at /docs/workspace-security.
SourcesBackground on two things the security page leans on. PostgreSQL row security policies (opens postgresql.org in a new tab), OWASP Top Ten (opens owasp.org in a new tab).
Read next
Every plan
Every plan
Every plan
Every module is in the same workspace, so nothing needs connecting to anything.
Free for up to 5 users. Pro free for 30 days. No card.