Built for the enterprise from day one. Secured like it.
“Can we trust it with how the whole company runs?”
Dotwork holds the most sensitive picture a company has — its strategy, budgets, portfolio, architecture and controls. So we never treated security as a feature to add later. It was designed in from the first line of code, it’s deployed in the Fortune 50 and in government, and it’s independently audited every year.
Independently audited
SOC 2 Type II · ISO 27001 · GDPR
- EncryptionAES-256 at rest · TLS 1.2+ in transit
- IdentitySAML SSO · SCIM · IP restrictions
- AccessRole-based · audit logs
- HostingEU or US · dedicated deployments
- AISigns in as the person · writes off by default
- RecoveryMulti-AZ · cross-region backups
Fortune 50
Running inside some of the largest and most scrutinized companies in the world.
Government
Deployed in government, where security reviews leave nothing to assumption.
SOC 2 Type II
Regular independent audits of our Service Organization Controls.
ISO 27001
ISO/IEC 27001:2022 certified information security management system.
What changes
Security we take seriously.
Security added once the big customers asked
Built for the largest, most regulated organizations from day one
One shared environment for everyone
Every customer isolated — with dedicated, single-tenant deployments available
AI with a service account and broad access
AI that signs in as the person and sees only what they can
Trust us
Independent audits, continuous scanning and documentation ready for your review
Compliance
Independently verified. Not just promised.
Our security controls are audited by independent third parties against the standards your security and procurement teams ask for.
SOC 2 Type II
Dotwork undergoes regular Service Organization Controls audits (SOC 2 Type II), independently verifying our security controls.
ISO/IEC 27001:2022
Dotwork has achieved ISO/IEC 27001:2022 certification for its information security management system.
GDPR
Committed to compliance with Europe’s General Data Protection Regulation, with a Data Processing Addendum ready for your legal team.
Data Processing AddendumNeed our SOC 2 report or ISO certificate? Request them from our Trust Center.
How we think about it
The system that runs the company has to be the hardest one to break into.
Built in, not bolted on
Dotwork holds strategy, budgets, portfolios, architecture and controls — the most sensitive picture of how a company runs. We designed for that scrutiny from the first line of code.
Least privilege by default
People, tokens and AI get only the access their role needs. Powerful capabilities — like AI write access — start off and are switched on deliberately.
Isolation everywhere
Each customer is a separate site, each connection is bound to one site, and dedicated deployments get their own network, compute and databases.
Verified, not asserted
Annual independent audits, daily automated scanning and penetration testing back every claim on this page.
Infrastructure and data
Your data, encrypted, isolated and recoverable.
Protecting your data with strong encryption, strict isolation and backups you can count on.
Data encryption
HTTPS is forced on every connection. Data is encrypted with TLS 1.2+ in transit — TLS 1.3 where clients support it — and with AES-256 at rest. Traffic between internal services is encrypted too.
Dedicated deployments
Run on a dedicated, single-tenant deployment with its own isolated network, compute and databases — nothing shared with other customers.
Backups and recovery
Data is backed up several times a day, kept in versioned storage for a full year in production and replicated to a second region for disaster recovery.
Change history
Every change to a field is kept with who made it and when, and infrastructure activity is logged end to end.
Your data is yours
Customer data is never used to train AI models, and AI runs through enterprise model infrastructure on AWS.
Identity and access
Only the right people. Only what their role needs.
Flexible authentication that plugs into your identity provider, and access control fine-grained enough for the largest organizations.
SAML single sign-on
SAML 2.0 through most identity providers — Okta, Microsoft Entra ID, OneLogin, Auth0 and more — so your MFA, password and lifecycle policies apply to Dotwork.
SCIM provisioning
Provision and deprovision users in Dotwork automatically through your identity provider.
Enterprise sign-in
Sign in with Microsoft — including Microsoft’s US Government cloud — Google, GitHub or email.
Login restrictions
Restrict sign-in to the methods you choose, such as SSO only, for added security.
Domain claiming
Claim your company’s domains to add an extra layer of security and keep people in the right site.
IP restrictions
Restrict access to your Dotwork site to your private network.
Role-based access control
Predefined and custom roles, with administration split so no single admin holds every key — sign-in, permissions and content are managed separately.
Short-lived sessions
Access tokens expire in minutes and are refreshed securely, so a leaked token is worth little.
Scoped API tokens
Every API token is bound to one site and one role, and can be revoked at any time.
Admin and site controls
Your admins decide who sees what, from where.
Controls that let your administrators shape access to your site, see what happened in it and decide where its data lives.
Audit logs
Audit logs automatically keep track of important site events over the last 3 months.
App approvals
Control which third-party applications have access to your Dotwork site.
Admin controls
Restrict access to system-level privileges to the people who need them.
Private spaces
Create private spaces for work that only certain members should access.
Guest access
Invite contractors, external stakeholders and partners with limited access.
EU or US hosting
Choose to store your data in the European Union or the United States.
AI security
AI governed like a person, because it acts as one.
Dot and every connected AI work through the same sign-in, permissions and site rules as the person using them — so opening the model to AI never opens a new hole.
Signs in as the person
AI clients connect with OAuth 2.1, PKCE and an explicit consent step — no shared service account.
Sees only what they can
Every AI call carries the person’s own permissions. In planning, that reaches down to the cost centers and sensitive columns they may see.
One site per connection
Each AI connection is bound to a single Dotwork site, so nothing crosses between environments.
Writes off by default
AI write access stays off until a site’s admins turn it on, and admins can switch off any individual tool.
Approvals for change
Changes proposed by AI can require a person’s approval before they’re applied — routed to the right approver.
Every call traced
AI activity is traced and its cost attributed to the site and space that used it.
Company security
Security is how we run, not a team we have.
Maintaining organizational integrity through stringent, independently audited security practices.
Secure lifecycle
Security is built into every stage of development, with industry-standard practices to find and fix vulnerabilities before anything ships.
External audits
Independent annual audits evaluate our policies, including Information Security, Third-Party Risk Management, Business Continuity, Incident Response and End-User Data Privacy.
Risk assessments
Regular risk assessments keep a full picture of the threats to the security, availability and privacy of our services.
Vulnerability scanning
Code, container images and infrastructure are scanned every day, and dependencies are updated every week. High-severity issues are fixed within defined SLAs.
Penetration testing
Ongoing penetration testing finds, prioritizes and fixes vulnerabilities before attackers can.
People and access
Strict role-based access across internal systems, MFA on internal tools and regular security awareness training for everyone at Dotwork.
Resilient operations
Always on, because your operating model is.
Monitoring
Continuous monitoring, threat detection and on-call alerting for peak performance and fast incident response.
Edge protection
A web application firewall with rate limiting, managed rule sets and IP reputation filtering sits in front of every request.
Redundancy
Infrastructure spans multiple availability zones, with backups replicated across regions for reliable recovery.
Availability
Tailored, white-glove support designed around your team’s needs, with enhanced support beyond our standard SLAs.
Service levelsContinuity
A defined business continuity approach keeps operations running through disruptions.
Ready for your review
Bring your toughest security questionnaire.
We work through security reviews with Fortune 50 and government teams. Our documentation is ready, and our team will meet your security, legal and procurement reviewers wherever they need detail.
Be Decisive.Build Fast.Connect Everything.
Start ConnectingSolutions
Platform
Resources
© 2025-2026 Dotwork, Inc. All rights reserved.