For your IT and procurement review.
This page covers how WorkmanIQ keeps each organization's data separate, controls access, protects credentials and public forms, and uses AI. It also lists the documents we can provide for procurement.
How the platform is secured.
Separate data for each organization
Organization scoping is enforced in the database query layer, so one organization's data can't appear in another's results. Nothing is shared between organizations.
Role based access
There are six built in roles: Requestor, Technician, Contractor, Supervisor, Admin, and Executive. The server checks the role on each request, and the interface hides actions a user can't take.
Encrypted credentials
API keys for OpenAI and other integrations are stored encrypted for each organization. If an organization hasn't set its own key, the platform key is used.
Encryption in transit
All traffic runs over HTTPS using current TLS versions. Older protocols are turned off, and the site qualifies for HSTS.
Protecting public forms
The citizen portal and public webhooks use reCAPTCHA v3 and IP rate limiting. All user input is sanitized before it is stored.
Audit trail
Status changes, assignments, comments, and edits are logged with the user, the time, and where the change came from. You can see the full history of any record.
How the AI features use your data.
This is usually the first question we get from buyers. AI requests are limited to your organization, capped per user, and logged. The assistant can read data but cannot change it, and your data is not used to train outside models.
Limited to your organization
- Each AI request only has access to the requesting user's organization
- The AI Assistant can look at data but cannot change it
- If you provide your own OpenAI key, it is used; otherwise the platform key is used
Usage limits and logging
- Each user has a limit on AI requests (100 per hour by default) to control cost and prevent abuse
- Each request is logged with the user, model, token count, and result
- High volume features use GPT-5-mini; the assistant and SOP drafts use larger models
What is sent to the model
- Only the information needed for that specific task, never a copy of your database
- Residents' names, emails, and phone numbers are left out of triage requests unless they are needed
- Manuals you upload for SOP drafts are sent only to pull out the steps and details
What is not
- Your data is not used to train outside models, under OpenAI's API terms for paid accounts
- Data is never shared between organizations, for AI features or anything else
- AI features can be turned off for your organization if local rules require it
Documents and terms for procurement.
Documentation
- Security questionnaire responses (SIG Lite and CAIQ formats)
- Data Processing Addendum (DPA) on request
- Standard MSA and SaaS subscription terms
- Reference architecture and data flow diagrams
- Certificates of insurance on request
Deployment and onboarding
- Cloud hosted, with no servers for you to set up
- Your own subdomain or a custom domain
- Standard onboarding of divisions, roles, and asset import takes 2 to 4 weeks
- You can start with one department and add others later
- Existing assets and PMs can be imported from CSV or ESRI
Licensing for government
- Priced per organization, not per user
- Annual or monthly billing
- State and municipal cooperative purchasing accepted
- Free pilots for qualifying agencies
Support and uptime
- Support requests go straight to the engineers who build the product
- 99.9% uptime target
- A status page for incidents and planned maintenance
- Documented backup and restore procedures
Security frameworks we follow.
Our controls follow widely used public sector security frameworks. We will pursue formal certifications as customers require them.
Need our security packet?
Send us your procurement requirements and we will reply with the questionnaire, DPA, and reference architecture.
Request the packet arrow_forward