Security and data handling
Understand access controls before sharing employee data
LVC WorkOS is in internal production use. Public release is planned. This overview describes controls implemented in the application source, not an independent audit or a guarantee about every endpoint. The platform may hold employee, attendance, project and payroll information, so access and data collection need an organisation's review.
Sign-in, sessions and access checks
Password sign-in uses bcrypt verification. Application session tokens are signed and expire after 24 hours. Production session cookies are configured with Secure, HttpOnly and SameSite=Lax attributes. Backend routes include server-side role checks and organisation-scoped queries. These mechanisms are not a claim of independently verified isolation across every endpoint. Administrators should review permissions before granting access to employee records.
Privacy questions to resolve before rollout
This page is not a Privacy Policy, DPA or cookie notice. Request approved legal documents from your LVC contact before entering production data. Confirm the purpose of collection, retention and deletion rules, subprocessors, data location and the process for employee data requests. Account creation is not blanket permission for marketing.
Security questions and reporting
Report suspected issues to info@lvc-solutions.com with the subject LVC WorkOS security. Send an affected URL and safe reproduction steps, not credentials or employee data. No SOC 2 or ISO 27001 certification, bug bounty or response-time guarantee is claimed here. Data location, subprocessors, retention, encryption at rest, backup recovery, MFA enforcement and incident-response commitments require separate operational confirmation.