Security
Architecture
workthin implements defense-in-depth:
- Secret Protection — 3-stage pipeline masks secrets before storage
- Access Control — Row Level Security (RLS) per user and project
- Encryption — AES-256 at rest, TLS 1.3 in transit
- API Authentication — Bearer token + Supabase cookie auth
Sub-processors
| Service | Purpose | Data Location |
|---|---|---|
| Supabase | Database, Auth, Storage | US |
| Vercel | Hosting, CDN | US |
| OpenAI | Structuring, Tagging, Embedding | US |
| Stripe | Payments | US |
| PostHog | Analytics | US |
| Upstash | Rate Limiting | US |
Data Policy
- We do not use your data to train AI models
- You own your data — export or delete anytime
- GDPR-ready data deletion on request
AI Data Handling
workthin uses the OpenAI API for structuring, tagging, embedding, and classification. API data is not used for model training:
"OpenAI does not train on data sent via the API by default."
See also: Enterprise privacy at OpenAI, How your data is used