Security

Effective September 3, 2026Last updated September 3, 2026Outworx for Web-Design, trading as Underlayer

This page describes the controls that are actually in place, in enough detail that you can check most of them yourself against the API and the documentation.

It is not a compliance summary and does not claim a certification we do not hold. Where something is missing, Section 8 names it.

1. Signing in

Underlayer does not store passwords, because it does not accept them. An Authorized User signs in with a one-time link sent to their work email, with Google or GitHub, or with a passkey where their browser supports one. There is no password on our side to be guessed, reused, or leaked in someone else's breach.

Sign-in links work once and expire. Sessions are held in HTTP-only cookies, refreshed server-side, and can be listed and revoked from the account page.

2. Keeping workspaces apart

Every table that holds customer data has row level security enabled, and access is scoped to the workspace a member belongs to. That check runs inside the database rather than in application code, so a missing filter in a query cannot return another workspace's rows.

The privileged service-role credential exists only on the server, is never sent to a browser, and is used for the specific operations that legitimately act outside a single user's permissions — issuing a certificate, delivering a webhook, running a scheduled job.

3. API keys

An API key is shown once, at the moment it is created, and stored as a SHA-256 digest. We cannot recover a key you have lost, which is the point: a database dump does not yield working credentials. Keys carry a visible prefix so you can tell them apart in your own logs without writing the secret down.

Keys are issued from the dashboard by a member of the workspace, never automatically, and can be revoked from the same screen. Every API request is rate limited and checked against the plan's limits before it does any work.

4. Webhooks

Every webhook delivery is signed with an HMAC over the raw request body using a secret unique to that endpoint, and carries a timestamp. Verifying the signature before you act on a payload is what stops anyone who learns your endpoint URL from inventing a completion. The signature scheme, and code that checks it, are in the webhooks documentation.

Deliveries are retried with backoff and every attempt is recorded, so a failure is visible in the dashboard rather than silent.

5. Learners and the embed

A learner never has an account with us. Your product provisions an identity through the API and the embedded player carries a short-lived signed session token for that identity — no learner password, no learner email required, and no cookie of ours in their browser.

If the identifier you pass is opaque to us, we cannot connect a learner's progress to a real person at all. That is the recommended way to use the product and it is described in the Privacy Policy.

6. Content authors supply

Where an author gives us a URL — an embed block, or a check on whether a page can be framed — the server resolves the hostname first and refuses private and loopback addresses, then re-runs that check on every redirect it follows. Without it, a URL box on a signed-in page is a way to make our servers fetch things on our own network.

Text an author writes is rendered as a closed set of elements rather than as markup, so a course cannot inject script into the player.

7. Data in transit and at rest

All traffic to the API, the dashboard, and the embedded player is over TLS. Data at rest is encrypted by our infrastructure provider, and backups stay within that provider's managed backup system rather than being copied anywhere else.

Delete a workspace and the data goes within 90 days, backups included. What each third party receives is listed on the sub-processors page.

8. What we do not have

Underlayer has no SOC 2 report and no ISO 27001 certificate today. Neither is in place, and we would rather say so here than let a security questionnaire find out for you. If your procurement process requires one, tell us — it is useful for us to know how often it blocks a purchase.

We can sign a Data Processing Addendum, and we will answer a security questionnaire directly and in writing.

9. Reporting something

If you believe you have found a vulnerability, email security@underlayer.outworx.io. Tell us what you found and how to reproduce it, and give us a reasonable window to fix it before publishing. We will confirm we received it, keep you updated while we work, and credit you if you would like to be credited.

We do not run a paid bounty programme. We will not pursue anyone who reports a genuine issue in good faith and does not access, alter, or retain other people's data while finding it.

Drafted for Underlayer under UAE law, including Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. Have counsel review it before it governs a live customer relationship.