Trust you can check.

Every organization is verified before it can issue

Control of its domain

A code sent to an address at the domain and a DNS record published on it, re-checked daily.

A real, registered business

Legal name and tax ID confirmed through business verification, with the representative matching the person applying; public registries where they apply (.gov, accreditation, regulators).

No imitations

Names and domains are compared with protected names (major banks, platforms, governments and their defense agencies), confusable spellings and every organization already on WorkPair; the domain must match the name; domains under 180 days old are never approved automatically.

Authority confirmed out of band

When anything is uncertain, a WorkPair reviewer contacts the organization through its public records, never a contact from the application, and records how. Protected names and military domains need two different reviewers.

Sanctions screening

The organization and the people who act for it are screened against the US (OFAC), UN, EU and UK lists, refreshed daily, including close spellings and transliterations. A possible match is settled by a person, never by a name alone.

People prove who they are, and keep the keys

Identity check

A government ID document, a selfie and a liveness check before anyone can hold credentials or act for an organization. One WorkPair ID per person.

Keys stay with the person

Signing keys are created on the person’s devices, in secure hardware (Secure Enclave, StrongBox) or as passkeys where available. WorkPair never holds a usable key: the optional backup is encrypted with a passphrase only the person knows.

Every credential names who signed it

An organization’s credential is countersigned by an identified person at that organization, over the exact content, so it can’t be issued anonymously or altered.

Nothing is shared without consent

A verifier sees only what the person allows, case by case or by rules they set, and sees the issuer’s verified domain and what was verified about it.

History that can’t be quietly rewritten

Hash-chained log

Every change is appended to an event log where each entry commits to all earlier ones; the database rejects edits and deletions of the log.

Public signed checkpoints

The log’s signed heads are published. Keep copies: if history were ever rewritten, your copies would no longer match. Latest checkpoint · Signing keys

Two-person control

Granting staff access, revoking an organization’s signing key and changing a verifier’s standing each need two different administrators.

Data protection and engineering

Encryption

Personal fields are encrypted individually in the database, bound to the record they belong to; all traffic uses TLS with HSTS.

Least data

Verifiers receive facts, not documents; identity-check images stay with the identity provider; delivered email content is deleted.

Supply chain

Our build pipeline blocks known high-severity vulnerabilities in production dependencies and records a software bill of materials (CycloneDX) for each build.

Service providers

A short, published list of subprocessors. Subprocessors

Report a vulnerability

Email support@workpair.io with “Security” in the subject. We aim to acknowledge reports within two business days and keep you informed until the issue is resolved. Please give us a reasonable time to fix an issue before disclosing it, and don’t access other people’s data or disrupt the service while testing. Our contact is also at /.well-known/security.txt.

For security and procurement reviews

We share our threat model, control descriptions and architecture with organizations evaluating WorkPair. Independent audits are in preparation; we don’t claim certifications we haven’t completed. Write to support@workpair.io.