Last updated: July 2026
Teachers trust Workshopy with their workshop content and run it live in front of a room. Here is, concretely, how that data is protected — and what to do if you find a problem.
All traffic between your browser and Workshopy is encrypted with TLS (HTTPS everywhere). Data is encrypted at rest: the database, file storage, and backups run on managed infrastructure (Supabase on AWS) with AES-256 disk-level encryption.
Every table in our database enforces Postgres Row Level Security: each query runs with your identity, and the database itself — not just the application — rejects access to rows you don't own. Writes go through server-side procedures that re-check permissions on every call. Participants in a session can only reach that session's data, and only while they are members of it.
Images you upload live in a private storage bucket in a folder scoped to your account — there are no public file URLs. Files are served through short-lived signed URLs, minted only for you or for participants of a session that actually uses the file.
Students join with a code and a display name — no account, no email, no install. The best protection for participant data is not collecting it in the first place.
Checkout and billing are handled by Polar as merchant of record. Card numbers are never sent to or stored on Workshopy servers.
Operating the platform requires administrative access to the database. Our policy is strict: staff access account data or content only to resolve a support request you made, to investigate abuse or a security incident, or when legally required — never to browse content. We do not use your content to train AI models and we never sell data.
Workshops are plain Markdown. Export any template as a single .md file and any session report as Markdown, at any time, on any plan. No proprietary format, no lock-in — if you ever want to leave, your content goes with you.
Workshopy is built by a small team and does not yet hold formal certifications like SOC 2 or ISO 27001. If your organization needs a security questionnaire filled in or has specific requirements, email us — we'd rather answer directly than overclaim.
If you believe you've found a security issue, please email security@workshopy.iowith details. We read every report, respond quickly, and won't take action against good-faith research.
For what data we collect and why, see the Privacy Policy.