About Workwae
A hosted API for email, calendars and contacts, run by WORKWAE LLC.
One API across Gmail, Microsoft 365 and IMAP.
Workwae holds each provider's sign-in, scopes and push setup, and gives developers the same mail, calendar and contacts calls. It also creates Zoom and Webex meetings with calendar events and delivers every change as a signed webhook or a change feed.
Hosted, in the United States, sealed per record.
- Operator
- WORKWAE LLC, Texas, United States.
- Hosting
- Hosted service only; there is no self-hosted option. Data is stored at OVHcloud in the United States. Cloudflare provides delivery, DNS and DDoS protection. See subprocessors.
- Encryption
- Tokens, passwords, webhook secrets and stored content are sealed with AES-256-GCM under keys held in HashiCorp Vault, bound to their tenant and record. Message metadata used for search is not sealed per record. Details.
- Incidents
- We acknowledge security reports and keep reporters updated until resolved. If we learn of a breach affecting your information, we notify affected customers and, where required, end users and authorities. The Data Processing Addendum sets a 72-hour notice to customers.
- Compliance
- SOC 2 is planned and the audit has not started. We claim no other certification. Security and compliance.
- Status
- status.workwae.com
What you can check in the product.
-
Confirm before send, by default
When a member authorizes an AI app through MCP, the member confirms each email it sends unless a workspace admin changes the send policy. Source
-
Agents get the narrowest key
API keys carry scopes (read, write, send, admin). An agent key without send can draft but every send is refused. Source
-
Only the permissions in use
Calendar, contacts and shared-mailbox permissions are requested only when those features are on. Source
-
No ads, no selling, no AI training
Connected account data is never sold, used for advertising or used to train AI models. AI features are off until a customer turns them on. Source
-
Deletion that revokes
Deleting an account stops access at once and queues its Google grant for revocation. Its data is purged within 30 days. Source
-
Early access, stated plainly
We say what we do not have, including SOC 2 and the Google CASA assessment, on the security page. Source
Reach the team.
- Help
- support@workwae.com. We reply within two business days.
- Privacy requests
- privacy@workwae.com: access, export and deletion.
- Security reports
- security@workwae.com, also listed in security.txt. Reporting policy.
Build on Workwae.
We are onboarding a small number of teams. Tell us what you are building.