Transparency in how we protect your data, privacy, and account security.
Last audited: March 2026
Every feature we build is reviewed against these security pillars before deployment.
Row-Level Security (RLS)
Every database table enforces row-level security, isolating data per user so no one can access another user's records.
Public / Private Profile Separation
Personally identifiable information is stored in a private table. Only safe, public-facing fields are exposed through a separate view.
Privilege-Safe Database Functions
Security-definer functions execute with a locked search path, preventing privilege escalation attacks.
Server-Side Input Sanitization
All user input is sanitized server-side using DOMPurify and custom sanitizers before storage or rendering.
XSS Protection
HTML sanitization is applied to every piece of user-generated content, preventing cross-site scripting attacks.
Banned Email Domains
Over 300 disposable and spam email domains are blocked at registration, keeping the platform free from throwaway accounts.
Content Moderation Dictionary
An AI-seeded banned words dictionary with normalization catches offensive content even with character substitutions.
Identity Snapshot Triggers
Display names are immutably captured at creation time via database triggers, ensuring audit trail integrity.
Service Location Privacy
Full addresses are hidden from public view. Only city and state are exposed through a dedicated privacy-safe function.
Verification Privacy
Verification badge status is visible without exposing the underlying identity documents or personal data.
User Address Privacy
Street-level address data is restricted to account owners and administrators only.
Conversation Audit Logging
All message modifications are tracked with performer identity, creating a tamper-evident audit trail.
Cloudflare Turnstile CAPTCHA
All 7 login and registration forms are protected by Cloudflare Turnstile, blocking automated bot submissions.
Server-Side CAPTCHA Verification
CAPTCHA tokens are verified server-side via a shared verification module — client-side bypass is not possible.
IP-Based Rate Limiting
Email checks, early access forms, and OTP endpoints enforce IP-based rate limits to prevent abuse.
AI Spending Cap
A $3/day spending cap across all 20+ AI edge functions prevents runaway costs from abuse or bugs.
OTP Cooldown Periods
One-time password requests enforce cooldown periods, preventing spam and email cost abuse.
Email Verification Required
Accounts must verify their email address before activation, preventing fake account creation.
Password Reset Rate Limiting
Password reset OTP requests are limited to 5 per hour per email, preventing brute-force attacks.
Role-Based Access Control
A dedicated user roles table with a secure has_role() function provides granular, non-bypassable access control.
Super-Admin Gating
Sensitive administrative operations require super-admin privileges, verified server-side on every request.
Access Rights Waterfall
A granular per-page, per-action permissions system allows fine-tuned control over what each role can access.
Protected Routes
Route guards ensure unauthenticated users cannot access protected pages, with profile completion enforcement.
Separate Auth Portals
Talent Managers and Advocates have dedicated authentication portals with isolated session management.
Forced Password Change
Compromised accounts are flagged and users are forced to change their password before continuing.
Zod Schema Validation
All forms use Zod schema validation, ensuring data meets strict type and format requirements before submission.
File Upload Validation
Uploads are validated for file size, type restrictions, and filename sanitization to prevent malicious files.
Portfolio Upload Limits
Database triggers enforce portfolio upload limits, preventing storage abuse at the database level.
Atomic Stock Updates
Inventory management uses database triggers for atomic stock updates, preventing race conditions.
Collision-Proof ID Generation
Talent IDs, order numbers, and booking numbers use unique generation with collision checks.
Comprehensive Legal Policies
Standardized Privacy, Terms, Cookie, and Refund policies cover all platform verticals.
Full Account Deletion
A 15-step cascading data cleanup process ensures complete removal of all user data upon account deletion.
Mutual-Consent Deletion
Conversation data requires mutual consent from both parties before deletion, protecting all participants.
Access Logging
User access events are logged with device detection for security monitoring and anomaly detection.
Cookie Consent
Full cookie consent management with transparent disclosure of all third-party services used.
HTTPS/SSL Encryption
All data in transit is encrypted using HTTPS/SSL, preventing eavesdropping and man-in-the-middle attacks.
Secure Secrets Management
API keys and secrets are never stored in client code — all sensitive credentials are managed server-side.
Service Role Key Isolation
Edge functions use isolated service role keys, preventing client-side access to elevated privileges.
Uptime Monitoring
Continuous uptime monitoring ensures service availability and rapid incident response.
The rules below apply to every document and selfie submitted through any Workolo verification flow. They are actively enforced and form part of our Terms & Conditions.
Warning → badge revocation and Trust Score reset → temporary suspension → permanent ban and forfeiture of fees → reporting to law-enforcement and civil / criminal legal action under the Indian Penal Code, the Information Technology Act, 2000 and equivalent statutes in your jurisdiction.
At Workolo, your data isn't a product — it's a responsibility. We engineer every feature with security-first thinking, conduct regular internal audits, and continuously strengthen our defenses. The standards listed on this page aren't aspirational — they are actively enforced in production today.
Questions about our security practices? Contact us at admin@workolo.com