Coding agent documentation index Fetch the complete documentation index at: https://docs.worklittle.com/docs-agent-manifest.json Use this file to discover all available pages before exploring further.

Compliance and security

How Worklittle protects accounts, company data, and everyday access.

A plain-language summary of how Worklittle approaches security and responsible use.

What is protected

- Accounts and sign-in - Job seeker data: resumes, chats, and applications - Company data on Worklittle Business: candidates, employees, documents, surveys, and billing - API keys and payments

Access inside a company

On Worklittle Business, every teammate has a role. The role changes which pages appear and what chat is allowed to know.

- Can chat teammates get a personal experience. Hiring pages stay hidden, and chat does not surface pipeline or other people's private records. - Higher roles unlock more of the workspace only as needed. - Billing and spend limits stay with Full access and Owner, plus teammates an admin gave billing access. Everyone can open Usage, and only those roles see the whole organization there.

See Roles and permissions.

Sign-in and keys

- Sign-in uses Google, a one-time email code, or an optional password you set. See Trouble signing in. - Sessions and API keys are required for protected actions. - API keys inherit what their creator's role can do, so a limited teammate cannot mint a key that outranks them. - Public traffic to the site and API runs over HTTPS.

Infrastructure and monitoring

- Production services run on modern cloud infrastructure with secrets kept out of source code. - Operational issues are monitored so problems can be spotted and fixed quickly. - Suspected security incidents are triaged, contained, and remediated. When the law requires it, affected people are notified.

See the Information security policy. Worklittle does not advertise HIPAA or FedRAMP badges in Help. See Is Worklittle HIPAA or FedRAMP certified?.

Your responsibilities

- Invite people with the smallest role that still works for their job. - Remove teammates when they leave. - Keep API keys safe and rotate them if someone who had access leaves. - Do not paste secrets, government IDs, or card numbers into chat. - Verify a work email before publishing jobs. See Verify a work email.

Policies and contacts

| Document | What it covers |
| --- | --- |
| [Privacy policy](https://worklittle.com/privacy) | What we collect and why |
| [Terms of service](https://worklittle.com/terms-of-use) | The agreement for using Worklittle |
| [Information security policy](https://worklittle.com/information-security-policy) | How we protect systems and data |
| [Access controls policy](https://worklittle.com/access-controls-policy) | How access is granted and removed |
| [Data retention and disposal](https://worklittle.com/data-retention-and-disposal-policy) | How long data is kept |

Vulnerability reports: [contact@worklittle.com](mailto:contact@worklittle.com). Product help: Contact support. Which inbox: Who do I email?.