Security

Coworkkit puts an AI co-worker inside your product, where it talks to your users and operates your interface. That only works if it is safe by construction. Here is how it is built, and where to reach us.

It runs as the signed-in user, under their permissions

The co-worker is not a separate account with its own powers. It acts inside your app as the user who is already signed in, through the actions and surfaces you choose to expose to it. It can do what that user can do, and nothing more. There is no elevated, behind-the-scenes access to your backend.

Your key never reaches the browser

The integration is front-end, but your Coworkkit key is not. It is exchanged through one server-side token route that you own, so the secret stays on your server and the browser only ever holds a short-lived session token. You control who gets a session, and when.

Confirmation before sensitive actions

Actions you mark as sensitive wait for the user to confirm on screen before they happen. The co-worker can cancel one by voice, but it can never approve one. We're adding a default AI disclosure; until it ships, our Terms (§8) require you to tell your users they're talking to an AI.

Where your data goes

Sessions run in the EU (Frankfurt) or the US (N. Virginia) — you choose the placement mode. The control plane is in the US and the language model runs globally; the Privacy Policy §6 has the exact boundary. Coworkkit uses a small set of sub-processors for the voice stack (speech-to-text, the language model, and real-time transport). The current sub-processor list, what personal data we process, why, and how long we keep it, all live in one place we keep current:

• Privacy Policy — data we process, sub-processors, retention, and your rights.
• Terms of Service and Refund Policy.
• Data Processing Addendum: you accept it with the Terms; for a countersigned copy, email privacy@coworkkit.ai.

We are a young company and we would rather tell you exactly how the system is put together than wave a certificate at you. If your review needs something specific (a data-flow diagram or a sub-processor detail), ask and we will walk you through it.

Reporting a security concern

Email security@coworkkit.ai and we will get back to you quickly. If you believe you have found a vulnerability, please give us a chance to fix it before disclosing it publicly.