Security and trust

Your permissions, enforced on every answer

Coworker connects to the tools your company already runs on and only answers from what each person can already open. Independently audited, with the documents your security team needs.

Book a demoVisit the trust center

Security documents

  • SOC 2 Type II reportIndependent audit
  • Penetration test attestationThird party, annual
  • GDPRCompliant
  • Subprocessor listKept current
  • PoliciesIncident response, retention, encryption
Get the documents →
Compliance

Audited, assessed and tested by third parties

Coworker's controls are independently audited and continuously monitored. Your security team can get the reports from the Coworker trust center.

SOC 2 Type II

An independent audit of how Coworker's security controls work over time.

GDPR

Coworker meets GDPR requirements for handling personal data.

CASA Tier 2

Passed Google's security assessment for apps that access Google Workspace data.

Penetration testing

Independent security experts test Coworker's network and application at least once a year, and findings are tracked until they are resolved.
Permissions

People only get answers from what they can already open

Coworker builds its organizational memory from your connected tools, and it carries each source's access rules along with the content.

  • Everything Coworker learns keeps the permissions it had in the tool it came from.
  • Results are limited to what the person asking can open before anything is ranked.
  • If someone is explicitly blocked from something in the source tool, no Coworker setting overrides that.
  • Admins can open a shared source like a company wiki to everyone. Slack DMs, group DMs and Microsoft Teams chats always stay private.
  • Each customer's data is kept separate from every other customer's.
Identity

Sign in the way your company already does

SAML single sign-on

Connect your identity provider, such as Okta, so people sign in with their company account.

Google sign-in

Users can sign in with their Google Workspace account.

Multi-factor sign-in

Add a second factor with an SMS code or an authenticator app.
Infrastructure and data handling

Built on Google Cloud, with controls an auditor has checked

  • Hosted on Google Cloud in the United States.
  • Data is encrypted at rest with AES-256, and the Coworker app only accepts encrypted HTTPS connections.
  • Development, staging and production environments are kept separate.
  • Access to production data is restricted.
  • Automatic full backups, with restores tested at least once a year.
  • Clear retention and disposal policies govern how customer data is kept and deleted.
  • A tested incident response plan, with lessons-learned reviews built in.
Deployment

Our cloud, or yours

Run Coworker in our cloud, or as a self-hosted appliance in your own AWS or Google Cloud account when your data needs to stay in your environment.

Self-hosted and VPC deployment →
Subprocessors

The vendors that process data for Coworker

The full, current subprocessor list is on the Coworker trust center.

FAQ

Frequently asked questions

Request it from the Coworker trust center, which also has the latest third-party penetration test attestation letter.

No. Everything Coworker learns keeps the permissions it had in its source tool, and results are limited to what the person asking can open before anything is ranked. Admins can open a shared source like a company wiki to everyone, but Slack DMs, group DMs and Microsoft Teams chats always stay private.

Coworker runs on Google Cloud in the United States. If your data needs to stay in your own cloud, Coworker can run as a self-hosted appliance in your own AWS or Google Cloud account.

The full, current list is on the Coworker trust center. It includes Google Cloud for hosting and AI model providers such as Anthropic and OpenAI.

Bring your security questionnaire

We'll walk your security team through permissions, hosting and our security documents on a call.