Security and trust

What we hold

For each connected Xero organisation: documents awaiting approval (supplier, amounts, lines, account codes, attachments), the people who approve and every decision with who and when, the Xero connection's tokens, supplier bank details as Xero holds them for the bank-change check, and the certificate written back to Xero. We do not hold card details: Stripe takes payments on its own pages.

Where it lives

The application and database run on Laravel Cloud on AWS in Sydney. Separate staging and production environments with separate databases and keys. Nothing runs on office or home hardware. Attachments, certificates and partner logos are stored in Cloudflare R2, whose region Cloudflare does not guarantee; our privacy policy says so plainly. Email is sent through Resend with open and click tracking switched off, so approval links never pass through a third party's link rewriting. Subprocessors are listed on the Subprocessors page. AWS and Cloudflare are US companies, so US law can reach data they hold.

Organisations are kept apart by design

Every record carries the organisation it belongs to and every query is limited to the organisation you are working in; if none is set, a query returns nothing rather than everyone's data. A person who is not a member of an organisation gets "not found". Every change is checked by an automated test that signs in as one organisation's administrator and tries every page and action of another's.

Sign-in

• Two-step sign-in with an authenticator app, and passkeys, for everyone; required for organisation administrators, account owners, firm administrators and auditors.
• Sign in with Xero is available.
• Sessions end after 30 minutes idle. Changing a password or turning two-step off signs the user out everywhere. Users can sign out of other devices.
• Sign-in attempts are rate-limited, passwords are checked against known breaches, and sign-in and password reset do not reveal whether an address has an account.

Approval links

Approvers without a login use a personal link with a long random secret (only a hash is stored). Links expire, work only for that person and step, and stop working once that person has decided. Opening a link only shows the document: approving is always a separate button press on the page, so a mail scanner that follows every link in an email can never approve anything. Every use is logged with time, address and device. A high-risk bill needs an explicit acknowledgement on the page.

Evidence you can check

Each approval produces a certificate attached to the document in Xero before the document is authorised, so nothing is authorised without its certificate. Its link opens a public page that recomputes the check from our records; "check a file" hashes the file in your browser, so it is never uploaded. Anyone editing a document during approval restarts the approval, and a document authorised in Xero outside WorkApproved raises an alert. Nobody at WorkApproved, including us, can approve or reject on your behalf.

Encryption

Everything uses HTTPS (HSTS for a year; the .app domain is preloaded in browsers). Our hosting provider encrypts the database and backups by default (it holds SOC 2 Type II), and we add our own encryption for the most sensitive values: Xero tokens and two-step secrets are encrypted by the application (AES-256). Passwords are never stored, only a one-way hash, and every password is checked against known breaches. Logs are filtered so they never contain passwords, tokens, email addresses or bank account numbers.

Application protections

A Content Security Policy is enforced, with only Cloudflare Turnstile and Stripe as third-party scripts; app pages are marked noindex so customer screens never appear in search engines; attachments that a browser could run are always downloaded, never displayed; the Xero and Stripe webhooks are signature-checked.

Retention

Attachment copies 18 months; audit log 3 years; approval certificates kept while the account is open; everything deleted 90 days after cancellation (a copy already attached in Xero stays in Xero).

Staff access

WorkApproved staff use a separate console with two-step sign-in and passkeys; every staff action is logged. Staff cannot approve, reject or change a workflow for a customer. Staff access to customer data for support is described in the Terms.

Incidents

Security reports: [email protected]. We can sign every user out in one step and close the app while keeping Xero and Stripe webhooks answering. We notify affected customers, Xero and, where required, the Privacy Commissioner.

What we have done