Security & Compliance

All customer data is stored in the United States using AWS and Azure infrastructure. Data is encrypted at rest using AES-256 and in transit using TLS 1.2/1.3. Our infrastructure is deployed across multiple availability zones for redundancy.

We retain customer data only for as long as necessary to provide our services. Upon contract termination or customer request, data is securely deleted within 30 days. We provide data export capabilities so you can retrieve your data at any time.

Yes. We support SAML-based single sign-on (SSO) for enterprise customers. Multi-factor authentication (MFA) is enforced for all Coworked employees and available for all customer accounts.

Yes, Coworked is HIPAA compliant. We implement all required administrative, physical, and technical safeguards. We execute Business Associate Agreements (BAAs) with customers who require HIPAA compliance. Contact our security team to request a BAA.

Our AI processing is designed with privacy-first principles. Customer data sent to AI models is not used for model training. We use enterprise-grade API agreements with our AI providers (including Anthropic) that include data processing agreements and, where applicable, BAAs. All AI interactions are logged and auditable.

We maintain a documented incident response plan that is tested regularly. In the event of a security incident, affected customers are notified within 24 to 48 hours. Our incident response includes containment, investigation, remediation, and post-incident review phases.

Yes, we regularly complete vendor security questionnaires including SIG Lite, CAIQ, and custom formats. Please submit your questionnaire to our security team, and we typically respond within 5 business days.

Yes. We engage independent third-party firms to conduct quarterly penetration tests of our infrastructure and applications. Critical and high findings are remediated promptly. A summary of results is available upon request under NDA.