WorkOS: Trust page changed

Trust / securityChanged (not classified) (rule)Changed 2026-11-02 09:03 UTCtrust.workos.com

Summary

WorkOS’s Trust page removed displayed references to several organizational, privacy and continuity controls, and added physical-access and data-center access controls. This changes the public security information customers can review; the diff does not establish whether underlying practices changed.

Machine-written from the diff below (Sol; type: other). Check the diff before relying on it.

What changed

~~Struck in red~~ is what WorkOS removed; blue is what they added. Muted text is unchanged context.

Changed#1

…View ‹count› more Infrastructure Security controls Organizational Security Code of Conduct acknowledged by employees and enforced Visitor procedures enforced Data & Privacy Data retention procedures established Data classification policy established Internal Security Procedures Continuity and Disaster Recovery plans established Cybersecurity insurance maintained Development lifecycle established View ‹count› more Internal Security Procedures controls Subprocessors…

…View ‹count› more Infrastructure Security controls Organizational Security Visitor procedures enforced Internal Security Procedures Cybersecurity insurance maintained Physical access processes established Data center access reviewed View ‹count› more Internal Security Procedures controls Subprocessors…

Compared with the previous archived version (#1044 to #13058). Text is normalized before comparing: dates, counters and tokens show as ‹date›, ‹count›, ‹tok›, and noise-only edits are hidden. Rewindex shows changed passages with a few words of context, not a copy of the page. View the live page (opens in new tab).

Archive proof

Rewindex commits each page capture it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert. That proves these records existed by then and have not been changed since, by anyone, Rewindex included.

How the archive is checked, and what it cannot prove.

Oct 17
Before captured 19:42 UTC
In the 2026-10-17 checkpoint, timestamped by FreeTSA and DigiCert on Oct 19, 23:18 UTC. Record hash 211445293d786423…
Download proof
Nov 2
After captured 09:03 UTC
In the 2026-11-02 checkpoint, timestamped by FreeTSA and DigiCert on Nov 3, 00:42 UTC. Record hash 1175073404662050…
Download proof

History of this page

YesterdayWednesday, November 4Wed, Nov 4

1 page change

Content changed
09:01Page change
Trust pagechanged
WorkOS’s Trust page now lists employee Code of Conduct enforcement, data retention and classification policies, continuity and disaster recovery plans, and development lifecycle controls. Physical access processes and data center access review are no longer shown in this section; these are disclosure changes, not evidence that the underlying controls were discontinued.

Tuesday, November 3

1 page change

Content changed
09:01Page change
Trust pagechanged
WorkOS added a Data Security Incident notice stating it was investigating unauthorized access to an internal tool used by sales and customer-facing teams, with a link to its security bulletin. The investigation was ongoing in the archived notice; no start time, duration, impact level or customer impact was stated.

Monday, November 2

1 page change

Content changed
09:03Page change
Trust pagechangedthis change
WorkOS’s Trust page removed displayed references to several organizational, privacy and continuity controls, and added physical-access and data-center access controls. This changes the public security information customers can review; the diff does not establish whether underlying practices changed.

Cite this

Trust page changed on WorkOS’s Trust page, changed 2026-11-02 09:03 UTC (change 1 of 3).

Title: Trust page changed
Vendor: WorkOS
Date: 2026-11-02 09:03 UTC
URL: https://rewindex.com/change/p13058

All WorkOS changes WorkOS profile Markdown JSON