Trust Center

Everything a security or privacy reviewer needs to evaluate RecWorks. RecWorks is operated by Raft Education LLC (d/b/a Community Works Collective; d/b/a RecWorks).

Last updated: October 2026

Security Privacy Sub-processors Data processing DPA Contact

Security overview

Updated Oct 9, 2026

RecWorks is a focused platform operated by a small, accountable team. Our controls are documented below in plain language.

Encryption
TLS 1.2+ in transit; AES-256 at rest for all stored data and backups.
Access controls
Least-privilege access, scoped per-role. Production access is limited and logged.
MFA
Multi-factor authentication is enforced on every infrastructure account behind RecWorks: hosting, database, code repository and identity provider.
Backups
Automated daily encrypted backups of the primary database, with 7-day retention, in the same US region as production.
Monitoring
Hosting, database and sign-in activity are logged by Vercel, Supabase and Auth0, and reviewed when investigating an issue.
Incident response
Documented triage and containment process; affected customers and, where required, supervisory authorities notified within 72 hours.
Credential signing
Credentials are signed with Ed25519 (Data Integrity, eddsa-rdfc-2022), so tampering is detectable by any verifier.
Learner email
A learner's email address never appears in plain text in a published credential; it's stored as a salted hash.

Privacy policy

Updated Oct 9, 2026

This policy is specific to RecWorks Credentials, operated by Raft Education LLC (d/b/a Community Works Collective). It describes what we collect, why, where it lives, and the rights you have over it.

We do not use third-party analytics or advertising trackers. This site sets one cookie beyond what's strictly necessary: a language-preference cookie, set only if you accept it via the cookie banner and used only to remember your chosen language. The claims made here are reflected in how the site itself behaves.

Our privacy policy covers what we collect, why, how long we keep it, and your rights.

Sub-processors

Updated Jul 5, 2026

The third parties that process data on our behalf, with their role, the data shared, hosting region, and their own compliance attestations. Values shown are indicative pending final confirmation.

Sub-processor Role Data shared Region Attestations
Vercel Application hosting & CDN Name, email (hosting & delivery); badge images (Blob storage) US East (iad1) SOC 2 Type 2, ISO 27001
Supabase Database Name, email, credential records US West (Oregon, us-west-2) SOC 2 Type 2
Auth0 (Okta) Administrator authentication Admin name, email, credentials. No learner passwords are stored. US SOC 2 Type 2, ISO 27001
Twilio SendGrid Transactional email delivery Name, email US SOC 2 Type 2, ISO 27001
Circle Looking up a learner's membership tags in the organization's Circle community, when the organization connects one Learner email United States —
Embed host platforms (Circle, Notion, Thinkific) are operated and contracted by you, not by RecWorks. Our embedded forms run inside them, but no learner data is transmitted to those platforms by RecWorks.

Material changes to this list are published here before they take effect.

Data processing

Updated Jul 4, 2026
We collect only what issuing a credential requires: the learner’s name and email, and the evidence your criteria ask for, such as a reflection or a file.
Data minimization isn't a policy line for us — it's the design. We don't collect what we don't need to issue and deliver a credential.
What we collect
Learner name and email address; the credential records and evidence you configure. Nothing more.
Where it lives
United States regions (database in US West/Oregon; hosting in US East), on the sub-processors listed above.
Retention
Credential records are retained for the life of the credential so verification remains possible. Account data is deleted on request or account closure.
Data subject rights
Access, correction, export, and deletion requests are handled via privacy@recworks.co, typically within 30 days.

DPA availability

Updated Jul 3, 2026

A Data Processing Agreement is available on request. Email privacy@recworks.co and we'll send our standard DPA for review.

Request a DPA

Contact

Privacy and security questions go to a monitored RecWorks address:

privacy@recworks.co