Security and privacy

Where your data lives and what protects it.

The short version, with the documents behind it. Questions go to support@workelligence.com.

Hosting and data residency

EU data residency in Azure Germany (Germany West Central), with Microsoft's contractual and technical safeguards.
Encryption at rest and TLS 1.2 or higher in transit.
Every workspace is strictly separated from every other; a request can only ever see its own workspace's data.

Every member signs in with their own account. Roles decide what they see and may change: Owner, Admin, Member, Read-only, and your own roles with record scoping.
Two-factor authentication with an authenticator app and recovery codes, and a workspace can require it for everyone.
Sensitive changes, such as a new email address or a workspace export, ask for the password again.
Sessions end with the browser unless you tick Remember me; then they last 14 days.
API keys are stored as hashes, carry read or write scope, and can be revoked at once.

Finalized invoices are immutable and numbered without gaps; corrections are new documents. Time entries on a finalized invoice are locked.
Every change is attributed by name in the activity log, whether a person, a workflow or a connected assistant made it.
Only a person can finalize an invoice; a connected assistant can propose, never finalize.

The workspace owner can export the whole workspace at any time: every table as CSV and JSON, every file, with a README.
The export includes the data of modules that are switched off, so nothing is left behind.

Where the product uses an AI service (reading supplier invoices, writing project briefings), the provider is named in the privacy notice.
Connections to your own AI assistant go through the MCP server with a key you create and can revoke; approval mode keeps every proposed change waiting for a person.
On this website, the booking calendar from Calendly loads only after you click to show it.

A genuine review of how your team tracks time, plans work and bills clients today, and where it can improve.

No slides. No sales pitch. A genuine review.