Infrastructure

Security

Last updated: June 2026

How we protect accounts, contracts, and payment data on the platform.

Data protection

Traffic is served over HTTPS with strict transport security. Secrets and API keys are isolated per environment and never exposed to the browser.

Passwords are hashed with a salted key-derivation function. Sessions are server-side and bound to HTTP-only cookies.

Contracts, milestones, and escrow transitions are wrapped in ACID database transactions to prevent partial or inconsistent state.

Responsible disclosure is welcome at security@getwork.africa. Please do not publicly disclose issues before we have had a chance to remediate.

This is placeholder content for the Phase 1 MVP and does not constitute legal, financial, or compliance advice.