Security
Your work graph is yours.
One person’s capture must not become another person’s next move. That is the bar. This marketing preview does not store workspaces — it runs a local sample graph in your browser.
In short
- Isolation by workspace — recommendations run on your graph, not another team’s inbox.
- Encryption: TLS in transit + at rest when cloud ships. No secrets in logs.
- Access: HTTP-only auth cookies; SSO/SCIM for Intelligence teams planned. No training on your workspace.
1 · Isolation
Production workspaces will be isolated. Recommendations run against the graph you can see — not another team’s tasks, projects, or calendar. Team admins see workspaces they own; nothing leaks across the boundary.
Today: /app demo uses a sample graph stored locally via product-session.ts — no cloud multi-tenancy yet, so there is nothing to leak.
2 · Encryption
Production WAH will use TLS in transit and encryption at rest. Secrets and workspace content will not be written to application logs. Keys are managed by the hosting provider and rotated without shipping your graph.
3 · Access
- Auth sessions will use HTTP-only, Secure, SameSite cookies — not localStorage tokens.
- SSO and SCIM are planned for Intelligence teams (see Pricing).
- We will not sell workspace content or use it to train public foundation models. If a model provider processes a prompt on your behalf, it will be listed in DPA before it is turned on.
4 · Report an issue
Email security@wahtodo.com. We aim to acknowledge within two business days and keep you updated until closure. Please do not post the detail publicly before we can assess it.
Security is part of the architecture, not a feature we added later.
Questions? security@wahtodo.com · Business customers: DPA · Privacy: Privacy.