Security

How Legwork keeps your data safe

Last updated 31 October 2026

Where your data is stored

• The database is managed Postgres at Render, in Frankfurt, Germany.
• Uploaded files and the nightly backups are in Cloudflare R2, in storage held in the European Union.
• No customer data is kept in our code. An automatic check stops real names and data from being added to it.

Signing in and who can see what

• You sign in with Google. Legwork never stores a password, and your own Google security, including two-step verification, applies.
• Each person sees only their own data. Before anybody new signs in, an automatic test signs in as a new user and tries every page with other people’s records. It fails if any name, address or email of anybody else appears, including through the assistant connection.
• Pages for running the service are closed to everybody except the owner.
• Access to the hosting, the database, the storage and the email services is held by one person, with two-step verification.

Sending email

• Gmail is connected with the send permission only. Legwork cannot read, search, change or delete anything in your mailbox.
• The send permission is encrypted (AES-256-GCM). The key is kept in the host’s settings, never in the database, so a copy of the database alone cannot send anybody’s email.
• Nothing is sent without your yes. At most 20 emails a day from each person, at least a minute to undo, and every send is logged: to whom, the subject, when and which version.
• No open tracking and no tracked links, ever.

Encryption

• In transit: HTTPS for this website and the app. Connections to the database are encrypted.
• At rest: Render encrypts the database and its backups with AES-256, and Cloudflare encrypts every stored file with AES-256. The Gmail send permission is encrypted again by Legwork.

Replies

• Replies reach Legwork when you forward them. Legwork does not read your inbox.
• Mail forwarded from anybody who is not one of your contacts is recorded as ignored, and nothing of its content is kept.

AI and training

• Legwork never trains or fine-tunes a model on customer data.
• Anthropic (writing and research) and OpenAI (voice) do not train on data sent through their business services.
• The talking face is optional and made by Simli, who may keep the recording to improve their service. People’s names are never spoken in audio sent to Simli. Choose “just voice” and nothing goes to Simli.
• Every supplier, and what each may do with data, is listed on the privacy page.

Backups and recovery

• Nightly backups go to Cloudflare R2 in the EU, with a separate key that can reach only the backups.
• A full restore was tested on 24 October 2026 and matched the live database table by table.

Safety controls

• One switch stops all background work at once.
• Spending limits for each person and for the whole service.
• Changes that touch sending are never released within an hour of a booked send.

Not in place yet

Said plainly, so that nobody is surprised later:

• Export and delete in the app. Today they are done by email: we aim to answer within a week. The law allows us up to a month.
• A log of what administrators do.
• SOC 2, a penetration test and cyber insurance. Planned for the first team customer.
• Single sign-on (SAML) for teams.
• A registered company, and a signed data processing agreement for customers.
• A separate address for reporting security problems. Until then, write to hello@uselegwork.io.