Security and privacy
Your work stays with the people you share it with
Your projects hold drafts, sources and the names of the people you work with. Here's how we keep them to the people they belong to, said plainly, with nothing we can't stand behind.
Hosted in the EU
The database, the files and the encrypted backups, taken every 6 hours, are stored in the EU, on every plan, and every connection is encrypted. Each provider works under a data processing agreement and reads none of your content.
No AI
Nothing you write or upload is sent to an AI service or used to train one. A pasted brief is read in your browser by plain rules in our own code. No other service reads your content either.
The database decides who sees each row
Every table has row-level security switched on and forced, so the database itself limits each row to the people allowed to see it, whatever a screen asks for. Tests check, table by table and role by role, that no one reaches another space's or project's work, and a new table that forgets it fails them.
Files are checked before anyone opens them
Uploads wait in quarantine until ClamAV, on our own servers, has checked them for malware. Files are checked by what's in them, not by their name, and previews are drawn in your browser, not by a conversion service.
Private storage, links that expire
No file is public. A download link is signed for one file and expires after 5 minutes, and the database checks again that you may see it, so a leaked link is no use to anyone else.
No passwords to leak
You sign in with a link sent to your email. It works once and expires after 10 minutes. Sign-in attempts are limited, and you can sign out your other devices from Account.
Nothing from anyone else in your browser
No trackers, analytics services, font services or embeds. A strict content security policy lets only our own code run, and our tests fail if a page loads anything from another site.
We check our own work, and write it down
Before launch we reviewed Belaywork's security: who might try what, every table against every role, plan limits under many requests at once, sign-in, files, and everything a person can type or upload. Each finding was fixed with a test, or accepted with a written reason.
What we collect, and why
Your name and email are needed to use Belaywork. Everything else, from a picture to the hours you can give a project, is optional, shown only to the people the privacy notice names, included in your data download, and deleted with your account. Usage data counts events, never content, and you can switch it off.
Read the privacy noticeFound a problem?
If you think you've found a security problem, write to us at security@belaywork.com. Tell us what you found and how to see it again, and give us time to fix it before telling others.
Report a problemWhat we don't claim
We don't hold a security certification. If that changes, this page will say so.