Trust
Security you can check, not just read.
Where your data lives, who can see it, what agents can do with it, and who else processes it.
§ 01
Hosted in the EU
- The database, sign-in and files are stored with Supabase in Frankfurt, Germany.
- The app’s server functions run in Frankfurt on Vercel. Static files are served from Vercel’s edge network.
- Data is encrypted in transit (TLS) and at rest.
§ 02
Workspaces are kept apart in the database
- Every record belongs to one workspace, and row-level security in Postgres decides what each request may read or change, for the app, the API and MCP alike.
- A cross-workspace test suite runs in CI on every change and tries to read and write across workspaces.
- Team-only projects are visible to their team only, including in search, MCP and AI answers.
§ 03
Agents act as a person, never more
- MCP tokens are personal, work in one workspace, last 90 days and can be revoked at any time. Each shows when it was last used.
- A token sees exactly what its person sees. Agents must attach evidence to pass a check.
- Timers and checks that came through MCP are marked “via AI agent”.
- Passwords kept in a project’s Utilities are encrypted in Supabase Vault. Agents and Nova never see a password.
§ 04
AI you control
- The built-in AI sends the text of a request to OpenAI’s API, which does not use API data to train its models.
- Add your own OpenAI key under Integrations and requests run on your account instead.
- AI never changes tickets or code on its own; it proposes, and a person saves.
- Nova, the AI teammate, works with the session of the person who asks. Row-level security decides what it may read and change, exactly as in the app; tables with keys and tokens are out of its reach, and changes run only when that person confirms them.
- Specs quote their sources, and the server checks every quote word for word before it is shown. Documentation proposals must quote the diff.
§ 05
Our staff and your content
- NEWWORK staff do not read workspace content. To help with a question, a workspace admin can let support read the workspace for 1, 3 or 7 days, under Workspace settings → Data & privacy, and end it at any time.
- Support reads in a separate staff console with two-factor sign-in. It is read-only, opens no files, and every project list and ticket it opens is listed for the workspace’s admins.
§ 06
What we count
- The website sets no cookies and stores nothing in your browser. We count page views ourselves; a visitor is a hash with a key that changes daily, deleted after two days, and IP addresses are never stored.
- In the app we count, per workspace and day, how often screens, features and MCP tools are used, and the model, tokens and cost of each AI request. Never their content.
§ 07
Sign-in
- Sign in with email and password, a magic link, Google or Microsoft. Passwords need at least 10 characters with lower and upper case and a digit.
- On Business, admins prove the company’s domains with a DNS record and can require everyone with an address on them to sign in with Google or Microsoft. The database enforces it for every request, and turning it on ends the agent tokens of the people it covers.
- On Enterprise, SCIM 2.0 adds, deactivates and groups people from Okta or Microsoft Entra ID.
§ 08
An audit log you can export
- On Business, admins see every change in the workspace with who made it, whether an agent did, and what it was before, plus sign-ins, billing events and every page support opened.
- Filter it, export it as CSV or JSON Lines, or feed it to your SIEM through the API with an audit-only token. Entries are kept for a year and nobody can change them, our staff included; they go when the year is up or the workspace is deleted.
§ 09
Accounts and payments
- Owners can export a workspace or delete it, with everything in it, from Workspace settings.
- Stripe handles payments. Card numbers never reach our servers.
Subprocessors
Updated 15 October 2026
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Supabase | Database, sign-in and file storage | All workspace content, accounts and files | EU (Frankfurt, Germany) |
| Vercel | Hosting of the app and its server functions | Requests in transit, short-lived logs | EU (Frankfurt, Germany) for server functions; global edge network for static files |
| OpenAI | The built-in AI (Nova, briefs, specs, Pulse, Brainstorm), when used | The text sent with an AI request | United States |
| Stripe | Payments, invoices and tax | Billing contact, address, tax ID, payment details | EU and United States |
| Resend | Sign-in links, invitations and notifications by email | Email addresses and message content | United States |
| Sentry | Error reports from the app and its server | The error, browser, page path and server route; no ticket content, names or email addresses | EU (Frankfurt, Germany) |
Transfers to the United States rely on the EU–US Data Privacy Framework or the EU Standard Contractual Clauses. We tell workspace owners before a new subprocessor sees customer data.