# Security and trust What we hold, where it lives and how it is protected. Written for finance managers, boards and auditors. Report a security problem: [security@workapproved.app](mailto:security@workapproved.app) (also at [/.well-known/security.txt](https://workapproved.app/.well-known/security.txt)). ## What we hold For each connected Xero organisation: documents awaiting approval (supplier, amounts, lines, account codes, attachments), the people who approve and every decision with who and when, the Xero connection's tokens, supplier bank details as Xero holds them for the bank-change check, and the certificate written back to Xero. We do not hold card details: Stripe takes payments on its own pages. ## Where it lives The application and database run on Laravel Cloud on AWS in Sydney. Separate staging and production environments with separate databases and keys. Nothing runs on office or home hardware. Attachments, certificates and partner logos are stored in Cloudflare R2, whose region Cloudflare does not guarantee; our [privacy policy](https://workapproved.app/privacy.md) says so plainly. Email is sent through Resend with open and click tracking switched off, so approval links never pass through a third party's link rewriting. Subprocessors are listed on the [Subprocessors](https://workapproved.app/subprocessors.md) page. AWS and Cloudflare are US companies, so US law can reach data they hold. ## Organisations are kept apart by design Every record carries the organisation it belongs to and every query is limited to the organisation you are working in; if none is set, a query returns nothing rather than everyone's data. A person who is not a member of an organisation gets "not found". Every change is checked by an automated test that signs in as one organisation's administrator and tries every page and action of another's. ## Sign-in - Two-step sign-in with an authenticator app, and passkeys, for everyone; required for organisation administrators, account owners, firm administrators and auditors. - Sign in with Xero is available. - Sessions end after 30 minutes idle. Changing a password or turning two-step off signs the user out everywhere. Users can sign out of other devices. - Sign-in attempts are rate-limited, passwords are checked against known breaches, and sign-in and password reset do not reveal whether an address has an account. ## Approval links Approvers without a login use a personal link with a long random secret (only a hash is stored). Links expire, work only for that person and step, and stop working once that person has decided. Opening a link only shows the document: approving is always a separate button press on the page, so a mail scanner that follows every link in an email can never approve anything. Every use is logged with time, address and device. A high-risk bill needs an explicit acknowledgement on the page. ## Evidence you can check Each approval produces a certificate attached to the document in Xero before the document is authorised, so nothing is authorised without its certificate. Its link opens a public page that recomputes the check from our records; "check a file" hashes the file in your browser, so it is never uploaded. Anyone editing a document during approval restarts the approval, and a document authorised in Xero outside WorkApproved raises an alert. Nobody at WorkApproved, including us, can approve or reject on your behalf. ## Encryption Everything uses HTTPS (HSTS for a year; the .app domain is preloaded in browsers). Our hosting provider encrypts the database and backups by default (it holds SOC 2 Type II), and we add our own encryption for the most sensitive values: Xero tokens and two-step secrets are encrypted by the application (AES-256). Passwords are never stored, only a one-way hash, and every password is checked against known breaches. Logs are filtered so they never contain passwords, tokens, email addresses or bank account numbers. ## Application protections A Content Security Policy is enforced, with only Cloudflare Turnstile and Stripe as third-party scripts; app pages are marked noindex so customer screens never appear in search engines; attachments that a browser could run are always downloaded, never displayed; the Xero and Stripe webhooks are signature-checked. ## Retention Attachment copies 18 months; audit log 3 years; approval certificates kept while the account is open; everything deleted 90 days after cancellation (a copy already attached in Xero stays in Xero). ## Staff access WorkApproved staff use a separate console with two-step sign-in and passkeys; every staff action is logged. Staff cannot approve, reject or change a workflow for a customer. Staff access to customer data for support is described in the [Terms](https://workapproved.app/terms.md). ## Incidents Security reports: [security@workapproved.app](mailto:security@workapproved.app). We can sign every user out in one step and close the app while keeping Xero and Stripe webhooks answering. We notify affected customers, Xero and, where required, the Privacy Commissioner. ## What we have done | Item | Status | |---|---| | Two-step sign-in and passkeys | Done | | Organisation separation tested on every change | Done | | Automated checks of dependencies for known problems | Done | | Full internal pre-launch security review, 22 Oct 2026 (OWASP Top 10, ASVS level 2 orientation, tenant isolation, money correctness, privacy): no critical and no high findings; every fix-soon item fixed the same day | Done | | Earlier internal security, performance and quality audits (8-9 Oct 2026): 35 findings, all fixed or ruled on | Done | | Content Security Policy enforced | Done | ## Start your free trial 7 days free. A card is needed to start. From NZ$39 + GST per Xero organisation per month, unlimited users. [Start free trial](https://go.workapproved.app/register). --- Start a free trial: https://go.workapproved.app/register (7-day free trial, card needed) · Sign in: https://go.workapproved.app/login Contact: hello@workapproved.app (support) · security@workapproved.app (security reports) Legal: [Terms](https://workapproved.app/terms.md) · [Privacy](https://workapproved.app/privacy.md) · [Partner terms](https://workapproved.app/partner-terms.md) · [Subprocessors](https://workapproved.app/subprocessors.md) WorkApproved is a product of [Stone Pritchard Limited](https://stonepritchard.com), [NZBN 9429053953216](https://www.nzbn.govt.nz/mynzbn/nzbndetails/9429053953216/), New Zealand. © 2026 Stone Pritchard Limited. Xero is a trademark of Xero Limited. WorkApproved is an independent product and is not endorsed by, or affiliated with, Xero.