Our Commitment
Worxley handles some of the most sensitive data a business holds — customer and lead records, communication history, deal and quotation details, and payment information. We take this responsibility seriously. Security is not a feature we added after the fact; it is built into every layer of the platform.
This page describes the technical and administrative measures we have implemented to protect your data. If you have specific security questions about a deployment, contact us at security@worxley.com.
Infrastructure Security
Data Centre & Hosting
All Worxley infrastructure is hosted in India — specifically in the Mumbai (ap-south-1) region — on ISO 27001 and SOC 2 Type II certified data centre facilities. We do not host customer data outside India. Data is replicated across geographically separated availability zones within India for high availability and disaster recovery, without any cross-border transfer.
Network Security
Our production environment is isolated in a private Virtual Private Cloud (VPC). All public-facing components sit behind a managed Web Application Firewall (WAF) with continuous DDoS mitigation. Internal service-to-service communication occurs exclusively within private subnets. Inbound access to production servers is restricted to specific IP ranges via security groups; direct SSH access from the public internet is not permitted.
Availability SLA
We maintain a target uptime SLA of 99.97% for Worxley. Our infrastructure is designed with redundancy at every layer — compute, database, and storage. Automated health monitoring and alerting is active 24/7. We publish a real-time status page at status.worxley.com.
Backups & Retention
Customer data is backed up automatically every 24 hours with a minimum retention of 30 days. Backups are encrypted at rest using the same AES-256 standard as primary data. Backup restoration is tested quarterly.
Encryption
Worxley applies encryption at every layer where sensitive data is stored or transmitted:
| Layer | Standard | Scope |
|---|---|---|
| Data at rest | AES-256-GCM | All database storage, backups, and file assets |
| Sensitive fields | AES-256-CBC (field-level) | Payment details, customer PII, deal and quotation financial data |
| Data in transit | TLS 1.3 | All API calls, web traffic, and internal service communication |
| Passwords | bcrypt (cost factor 12) | User passwords — never stored in plaintext |
| Session tokens | HMAC-SHA256 signed JWTs | Short-lived tokens, rotated on each session |
TLS 1.0 and 1.1 are disabled across all Worxley endpoints. We enforce HSTS with a minimum one-year max-age across all production domains. Certificates are issued by trusted public CAs and rotated automatically before expiry.
Access Control
Role-Based Access Control (RBAC)
Access to data within Worxley is governed by a granular RBAC system. Permissions are configured at the field level — meaning a support rep can be given access to customer tickets but not deal financials, or a sales manager can view their team's pipeline but not company-wide revenue reports. Every permission combination is explicitly granted; default access is deny.
Multi-Factor Authentication (MFA)
Multi-factor authentication is available for all Worxley accounts and is mandatory for administrator-level users. We support TOTP-based authenticator apps. Accounts with admin privileges that do not have MFA enabled are flagged and escalated.
Internal Access Controls
Our employees do not have standing access to customer production data. Customer data access by our personnel requires a time-limited, approvals-based access grant, is logged with justification, and is reviewed by our security team. Our engineers access production systems only through a bastion host with mandatory MFA.
Audit Logging
All login events, data access events, configuration changes, and administrative actions are logged with timestamps, user identity, IP address, and session ID. Logs are tamper-proof, retained for 12 months, and monitored for anomalies in real time.
Application Security
Secure Development Lifecycle (SDLC)
Security is integrated into our development process from the design stage. All new features undergo security design review before development begins. Code changes are reviewed by a second engineer before merging. Automated SAST (static analysis) and dependency vulnerability scanning run on every pull request.
Vulnerability Testing & Remediation SLAs
We conduct third-party penetration tests at least once per year, and after any major architectural change. Identified vulnerabilities are triaged by severity and remediated within defined SLAs:
| Severity | Remediation Target SLA |
|---|---|
| Critical | 24 hours |
| High | 7 days |
| Medium | 30 days |
| Low / Informational | Next planned release |
OWASP Protections
Our application is built with defences against the OWASP Top 10, including parameterised queries (SQL injection prevention), CSP headers and output encoding (XSS prevention), CSRF tokens on all state-changing requests, rate limiting on authentication endpoints, and secure cookie attributes (HttpOnly, Secure, SameSite=Strict).
Operational Security
Employee Security
All Worxley employees undergo background verification before joining. Every team member receives mandatory security awareness training at onboarding and annually thereafter. Employees handling customer data sign confidentiality agreements that survive their employment.
Device Security & MDM
All company-managed devices are enrolled in a Mobile Device Management (MDM) system. Full-disk encryption is mandatory on all endpoints. Screen lock policies, remote wipe capability, and automatic OS update enforcement are applied universally.
Secrets Management
API keys, database credentials, and secrets are stored in a centralized secrets management vault, never in source code or configuration files. Secrets are rotated on a scheduled basis and immediately upon any suspected compromise.
Incident Response & Breach Protocol
We maintain a documented incident response plan that is tested through tabletop exercises at least twice per year. In the event of a confirmed security incident:
- Detection & containment: Automated monitoring systems alert the on-call team immediately. Affected systems are isolated to contain the incident.
- Assessment: Forensic evaluation determines the scope, nature, and impact of the incident.
- Customer notification: If a breach involves your Customer Data, we will notify you within 72 hours of breach confirmation.
- Remediation & post-mortem: Root cause is remediated, systems restored, and a written post-mortem shared within 14 days.
To report a suspected security incident, email security@worxley.com immediately.
Vendor Security
We maintain a strict vetting process for third-party vendors and sub-processors. Vendors with access to customer data sign Data Processing Agreements requiring security standards equivalent to our own and 48-hour incident notification SLAs.
Vulnerability Disclosure
We welcome responsible disclosure from security researchers. If you have discovered a potential vulnerability, please email security@worxley.com with steps to reproduce. We acknowledge reports within 2 business days and do not pursue legal action against researchers acting in good faith.