Security and privacy

Where your data is kept

Workletto runs in your own hosting account and keeps everything in your own database. We, the makers of Workletto, can’t see it, and the app doesn’t send it to us. This page also lists what we do receive.

• Your account, your database. Everything is stored in your own Postgres database, in a hosting account you own.
• Nothing sent to us. No telemetry and no license check: the app runs without ever contacting us.
• Outside services only when you turn them on. Email and Stripe payments stay off until an admin sets them up.
• Code you can read. The full source code is in your own private repository, so every claim here can be checked.

Where your data lives

• In your own hosting account. The app runs on Render or on a server of your own. You own the account and you pay the bill. Your hosting provider runs the server and the database, so it can reach your data too.
• In your own database. Time entries, clients, projects, invoices, people and passwords are stored only in your own Postgres database, in that same account. The app itself is a web server that people reach over the internet at its address, and they have to sign in. On Render, the setup closes the database to outside connections: only services in your Render account can reach it, until you add your own computer to run a backup.
• In the region you choose. The Render setup uses Render’s Oregon (US) region. To keep your data in the EU, change the region to Frankfurt in the render.yaml file of your copy before you deploy.

What we can’t see

• No telemetry. The app sends no usage statistics, error reports or analytics to us or anyone else. The sign-in library’s telemetry is switched off, and so are the database tool’s update checks.
• No license key. There’s nothing to check: the app never contacts us to start, run or unlock anything, and it keeps working even if our website is down.
• No access to your accounts. Nobody from Workletto is added to your hosting account or to your GitHub repository.
• Not even your code. Your copy is a private repository in your own GitHub account. We can’t see it or the changes you make to it.

Outside connections

Besides your hosting provider, the app connects to other services only when you turn something on or someone chooses to use it:

• Email, if you set it up. It’s off until an admin enters an SMTP mail server (their own, or an email service’s). The app then sends invite and reset links and invoices through it, only while sending.
• Online invoice payments, if you connect Stripe. They’re off until an admin adds their own Stripe keys. The app then talks to Stripe to create the page where a client pays an invoice (invoice number, amount, currency and the client’s email address, if the invoice has one). The money goes from your client to your Stripe account, not through us.
• Your Update app workflow, when you run it. It runs in your own GitHub repository, not in your app, and downloads the latest release from the public Workletto repository on GitHub. Nothing is sent to us, and none of your data goes with it.

Building the app, on your host or your own server, downloads its open-source components from public registries, as any Node.js app does. None of your data is involved.

Check the code yourself

You get the full source code in your own repository, so every statement on this page can be checked by you, a developer or an AI assistant. Updates arrive as a pull request you can read before you merge it. Nothing changes in your running app until you do.

Inside the app

• A new install asks for your setup code before anyone can create the admin account, so only you can claim it. After that, the setup screen doesn’t appear again.
• Passwords are stored as one-way hashes, never as plain text.
• People join only by invite link. A link works once, for 7 days, and only a fingerprint of it is stored.
• Roles limit what people see. Members see their own time, expenses and reports, the projects they can track time on (with total hours, but without rates, budgets or money), and the names of clients and colleagues, but not their email addresses or billing details, and no invoices. Admins can turn an account off, which signs that person out at once.
• Repeated sign-in attempts are slowed down: after 10 in a minute from one address, that address waits a minute.
• The app tells browsers to load its pages only from its own address (images embedded in a page and inline styles are also allowed) and not to show them inside other sites.

What we do hold

• Your donation, if you make one. Stripe takes the payment. We see your name, email address and the amount in our Stripe account; your card details stay with Stripe. We keep no customer database of our own. Installing Workletto needs no account with us.
• Anything you send us. For example, an admin can download a diagnostics file from the app (versions, which options are on, whether email and payments work; no secrets, addresses or business data). The app never sends it; if you share it with us, we see it.
• The live demo. The demo is a separate copy of Workletto that we run. Each visitor gets a private workspace with sample data, deleted after 2 hours (sooner if the demo is busy). Whatever you type there is on our server, so please don’t enter real client data.
• This website. It uses no analytics and no tracking cookies, and serves its own fonts.

The privacy policy (still a draft) will cover each of these in full.

How to check this yourself

1. Ask a developer or an AI assistant to read your copy of the code, list every outside address it contacts, and confirm that telemetry is switched off.
2. Open render.yaml in your repository. It lists everything Render creates: one web service and one database with its outside access list left empty.
3. Check who has access: your repository’s Settings → Collaborators on GitHub, and your workspace’s members on Render. Only people you added should be there.
4. Open your browser’s developer tools while you use the app. On the Network tab, the requests go to your app’s own address, and a client who pays an invoice online is sent on to Stripe.
5. Before you merge an update, read its pull request’s Files changed tab.

What we haven’t done yet

Workletto hasn’t had an independent security audit or penetration test, and it holds no certifications. Instead of custom security code, it relies on established, widely used parts: Postgres for your data and the Better Auth library for sign-in and passwords. Hosting security, such as encryption and backups, is your host’s; check Render’s own pages and your plan.

Found a security problem?

Please tell us privately first, so we can fix it before it’s public. Include what you found and how to reproduce it. Test only against your own install, never someone else’s or our live demo.

Email security@workletto.com.