# Security and hosting

> Where your data lives and what protects it.

## Hosting

The app runs with EU data residency in Azure Germany (Germany West Central), with Microsoft's contractual and technical safeguards. Data is encrypted at rest and in transit.

## Access

- Every workspace is strictly separated from every other.
- Members sign in with their own account; roles decide what they see and may change.
- Two-factor authentication can be required for a workspace, see [Two-factor authentication](/help/account/two-factor-authentication/).
- Sensitive actions ask for the password again.
- API keys are stored as hashes and can be revoked at once.

## Your records

- Every change is attributed by name in the activity log, whether a person, a workflow or a connected assistant made it.
- Finalized invoices are immutable and numbered without gaps; corrections are new documents.
- Time entries on a finalized invoice are locked.
- Only a person can finalize an invoice.

## Questions

Write to [support@workelligence.com](mailto:support@workelligence.com). The legal pages on the website hold the imprint and the privacy notice.