WorkOS by Befocusy WorkOS Help center

Encryption and credential protection

In transit: TLS 1.2 and TLS 1.3

All information travels encrypted with TLS, the protocol HTTPS is built on.

Between your browser and WorkOS:

  • The server only accepts TLS 1.3 and TLS 1.2. It rejects old, insecure versions (SSL, TLS 1.0 and TLS 1.1).
  • With TLS 1.2 it only allows modern ciphers: authenticated encryption (AES-GCM or ChaCha20-Poly1305) with forward secrecy. Even if the server key were ever compromised, it could not be used to decrypt previously recorded traffic.
  • Anyone who arrives via http:// is always redirected to https://. On the main WorkOS domain, the browser is also told to use HTTPS only for one year (HSTS).
  • The certificate is issued by Let's Encrypt, a recognized certificate authority, and renews automatically.

Between WorkOS and the services it works with (Notion, Google, Microsoft, AI providers and the other integrations):

  • Calls require at least TLS 1.2 and use TLS 1.3 when the service supports it. A connection with an older version is rejected.
  • WorkOS checks the service's certificate before sending anything.

Last check of this configuration: September 2026.

Connection credentials: encrypted

When you connect Notion, your email, your calendar, Slack or another tool, WorkOS receives a credential that lets it work on your behalf. Those credentials:

  • Are stored encrypted with AES-256-GCM, an authenticated encryption standard.
  • The encryption key is stored outside the database. A copy of the database, on its own, doesn't allow reading them.
  • Are only used from the server. They're never sent to your browser.

When you disconnect a tool from Settings → Integrations, WorkOS deletes its credential.

Codes and tokens: only their fingerprint

Some things aren't even stored encrypted: only a fingerprint (hash) is kept, which lets them be checked but not recovered. That's the case for:

  • Sign-in codes by email, for the app and for the Client portal.
  • Remembered devices.
  • Kairos connection tokens with Claude or ChatGPT.

So even if someone got into the database, they couldn't use them to sign in.

What depends on your tools

WorkOS acts with the permissions your tools grant it. That's why it helps if your Notion, your Google Workspace or your Microsoft 365 have two-step verification turned on and good management of who has access to what. See “Security: what WorkOS does and what's up to you”.