WorkOS
What WorkOS publishes, measured on their own site. Every result below links the page we found it on, or lists the addresses we checked.
- 60out of 100
- 10/10Criteria measured
- 2026-08-31Checked
Vendor site: workos.com · category: Password and identity
Data processing agreement
Published and readable without a login.
Source: https://workos.com/legal/data-processing-addendum · checked 2026-08-31
Subprocessor list
No subprocessor list found.
Checked 7 addresses on 2026-08-31.
Show the 7 addresses we checked
https://workos.com/legal/subprocessors– reached, no match (HTTP 200)https://workos.com/subprocessors– reached, no match (HTTP 404)https://workos.com/sub-processors– reached, no match (HTTP 404)https://workos.com/legal/sub-processors– reached, no match (HTTP 404)https://workos.com/trust/subprocessors– reached, no match (HTTP 404)https://workos.com/privacy/subprocessors– reached, no match (HTTP 404)https://workos.com/legal/subprocessor-list– reached, no match (HTTP 404)
Data location stated
The hosting location is stated on a public page.
Source: https://workos.com/security · checked 2026-08-31
Status page with history
A public status page with incident history.
Source: https://status.workos.com/ · checked 2026-08-31
Public pricing
Actual numbers on a public page.
Source: https://workos.com/pricing · checked 2026-08-31
Certifications named
SOC 2 or ISO 27001 named on a public page.
Source: https://workos.com/security · checked 2026-08-31
Uptime SLA with a figure
An availability commitment with a figure.
Source: https://workos.com/legal/sla · checked 2026-08-31
HTTPS enforced with HSTS
No enforced HTTPS with HSTS found.
Checked 2 addresses on 2026-08-31.
Show the 2 addresses we checked
http://workos.com/– redirects to https://workos.com/https://workos.com/– no HSTS header
No third-party tracking before consent
No consent-free first load found.
Checked 1 address on 2026-08-31.
Show the 1 address we checked
https://workos.com/– third-party requests before any interaction: alb.reddit.com, api.hubapi.com, cdn.jsdelivr.net, cdn.prod.website-files.com, cdnjs.cloudflare.com, d3e54v103j8qbb.cloudfront.net, js-na1.hs-scripts.com, js.hs-analytics.net, js.hs-banner.com, js.hsadspixel.net, pagead2.googlesyndication.com, region1.google-analytics.com, track.hubspot.com, www.googletagmanager.com, www.redditstatic.com
security.txt (RFC 9116)
No security.txt found.
Checked 1 address on 2026-08-31.
Show the 1 address we checked
https://workos.com/.well-known/security.txt– reached, no match (HTTP 404)