Security

WorkOS owns users, organizations, memberships, and sign-in. Rust enforces tenant scope and application authorization on every protected route.

Provider credentials remain in supported secure storage on the authorized worker or server. Native apps receive only the contracts and events they need.

Every run records exact source identity, model selection, host, policy, typed events, result, and redacted receipt. Sensitive memory and credentials are excluded from logs and notification payloads.