Company · Trust centre
Your data, your rules, and a record of every change.
Who can see what, who changed what, and when Workloom itself can look: each one enforced by the product and written down where your admins can read it.Who can see what, who changed what, and when Workloom itself can look: enforced by the product and written down for your admins.
Activity log
Support access
Activity logToday
09:12Priya changed Kabir’s role to AdminPerson
09:40Wren staged 4 record updates, approved by AnaWren
11:05Routing rule gave a new lead to Sales USRule
14:22Workloom support opened a read-only window, granted by PriyaSupport
16:58Ana exported the activity log as CSVPerson
The six controls
What the product enforces.
Roles
Roles and rightsRoles are sets of rights on a workspace, a space or an object; a deny beats every grant, and nobody grants more than they hold.Sets of rights on a workspace, a space or an object; a deny beats every grant.
Log
Activity log
Support
No standing access
Outside
Outside access
DPA
Data processingA Data Processing Addendum for customers, and the list of sub-processors below.A Data Processing Addendum and our sub-processors.
Yours
Your infrastructureDomains, inboxes and numbers are bought and held for your workspace, not shared with other customers.Domains, inboxes and numbers held for you alone.
Sign-in and sessions
Who gets in, and how you stop them.
An authenticator app with single-use recovery codes, required for admins if you choose.An authenticator app with recovery codes.
Roles, exports, deletes, API keys and purchases ask for a fresh code, even in an open session.Roles, exports, deletes and purchases ask for a fresh code.
Sessions end at onceRemove someone and every session they have open ends, on the web and on their phone.Remove someone and every session ends.
People come and go with your identity provider. Leavers are suspended, never deleted.Leavers are suspended, never deleted.
Limit a role to office networks or working hours; outside them it reads only, or is refused.
Wren and your records
Wren proposes. A person decides.
Staged, not savedWren stages changes and drafts. Nothing is written or sent until someone approves it, with that person’s rights.Nothing is written or sent until someone approves it.
Wren sees what the asker seesEvery question to Wren is answered inside the asker’s own reach.Every answer stays inside the asker’s reach.
Credentials stay sealedConnection tokens are encrypted at rest, kept out of logs and never returned by the API.Tokens are encrypted and never returned by the API.
Erasure requests remove a person and keep them suppressed.
Sub-processors
Who processes data for us.
The companies Workloom relies on to run the service, and what each one does.CompanyForWhat it does
Microsoft AzureInfrastructureHosting, databases, storage and AI models (Azure OpenAI).
GoogleChannelsGoogle Workspace mailboxes and calendars you connect.
Microsoft 365ChannelsOutlook mailboxes and calendars you connect.
TelnyxVoice and textsCalls and text messages.
MetaWhatsAppWhatsApp Business messages you send and receive.
CashfreeBillingPayments and invoices.
Can Workloom staff see our data?
How long is the activity log kept?
Where is our data stored?
Do you sign a DPA?
Yes. Every customer can sign our Data Processing Addendum.