Security and data handling

Answers for a security check sheet

The rows below follow the questions commonly found in cloud-service check sheets such as the one in IPA's guide to safe cloud use for small and medium-sized businesses. The sections further down give the details behind each answer.

Where data is stored

The database that holds equipment, bookings, members and other data (Amazon RDS for PostgreSQL), photos and attachments (Amazon S3), the application server (AWS Lambda) and sign-in accounts (Amazon Cognito) are all in the AWS Tokyo region (ap-northeast-1). AWS (Amazon Web Services) is a US company.

Email is the exception: invitations, verification codes, return reminders and other messages are sent through Amazon SES in the US East region (us-east-1), so their recipients and content pass through it. The AWS WAF log that records blocked and allowed requests to werp.in (source IP address, URL and the like) is also stored in S3 in the US East region and deleted after 90 days. Authorization headers and cookies are masked in that log.

Data sent to outside services

Besides AWS, Werp™ sends data to the following services.

Encryption in transit and at rest

• All traffic to werp.in, admin.werp.in and api.werp.in uses HTTPS. werp.in and admin.werp.in send HSTS (two years), so browsers do not connect over plain HTTP.
• The application server connects to the database over TLS and verifies the RDS certificate (since 2026-10-16).
• The database was created with storage encryption enabled. Photos and attachments are stored with Amazon S3's default encryption (SSE-S3).
• Passwords are managed by Amazon Cognito and are not stored in Werp™'s database.
• Tokens for the Google Calendar integration are encrypted in the application with AES-256-GCM before they are written to the database.
• Photos and attachments are stored privately and handed to the app as signed URLs that expire after two hours (since 2026-10-16).

Servers and network

• The database cannot be reached from the internet (since 2026-10-13). The application server runs in a private network inside AWS, and only connections from there and the operator's route (see “Access by the operator” below) reach the database.
• The database user the application connects with can only read and write data; it cannot create, alter or drop tables (since 2026-10-16).
• AWS WAF sits in front of werp.in and admin.werp.in and blocks IP addresses with a bad reputation, scans looking for secrets, and IP addresses that send large numbers of requests in a short time. AWS WAF cannot be attached to api.werp.in, so the API is protected by an overall request-rate cap and by per-IP and per-email-address limits.
• werp.in and admin.werp.in send a Content Security Policy that limits where scripts can be loaded from and which hosts the page can connect to (since 2026-11-06).
• The AWS account's activity log (CloudTrail) has tamper detection, and changes such as permission changes, making the database public or opening a security group trigger an email to the operator (since 2026-10-14). The database and the Cognito user pool that holds sign-in accounts have deletion protection.
• Vulnerabilities in third-party packages are tracked through GitHub Dependabot alerts, and packages are updated together once a month.

Workspace separation and permissions

All workspaces' data is in one database. Every row records which workspace it belongs to, and the API reads and writes only the rows of the workspace making the request. Workspaces do not have separate databases.

There are two roles, admin and member. Members cannot delete equipment, change other people's bookings, invite members, or change workspace and billing settings. For each item, you can limit who can see it and who can borrow it by user group; an item someone cannot see is treated as if it did not exist, even if they know its ID.

Some screens can be seen without signing in. When someone who is not signed in scans a QR label, a public page opens that shows only the unit name, model, owner and purchase date. Anyone who has a kiosk URL can see that unit's schedule for the day, including borrowers' names. Admins can revoke a kiosk URL at any time.

Sign-in and accounts

• Passwords must be at least 8 characters and use at least three of: uppercase letters, lowercase letters, digits and symbols.
• When an account is created, a verification code sent to the email address confirms that the person owns it.
• Sign-in, sign-up and password reset are protected by Cloudflare Turnstile against bots and by rate limits. Sign-in allows 20 attempts per IP address and 5 per email address in 15 minutes.
• Two-factor sign-in (a 6-digit code from an authenticator app) can be turned on by each person on their My Page. If someone loses their authenticator app, the operator turns it off after verifying their identity via support@werp.in.
• Signing out invalidates every access token issued before it. Resetting the password does the same.
• A sign-in lasts up to 30 days. The token used to renew it is kept in an HttpOnly cookie that the page's JavaScript cannot read.
• Single sign-on (SAML, OpenID Connect), SCIM user provisioning and restricting access by IP address are not supported.

Access by the operator

From its admin console (admin.werp.in), the operator can see a workspace's name and plan, its member list, the names, brands and models of its equipment, and usage counts.

Only operator accounts on an allow list can enter the admin console. Sign-in there is by passkey only (since 2026-10-26), so a password and one-time code stolen through a fake sign-in page are not enough to get in. Every action in the admin console is logged.

Direct connections to the database are possible only from the operator's AWS account through AWS Systems Manager Session Manager. The password of the database's admin user is managed by RDS and rotated automatically every 7 days.

Activity history and logs

• Each item's page shows its history (registration, changes, check-out, return and so on) with who did it and when. Members see the history only for items they can see.
• There is no workspace-wide list of actions and no export of the history.
• The activity history is not deleted automatically after a fixed period. Location history for the map is deleted after 365 days and in-app notifications after 90 days.
• The application server's logs are deleted after 90 days. Access tokens and the values of URL parameters are not written to the logs (since 2026-10-12).

Backups

• The database was created with 7 days of AWS automated backups. It also has deletion protection (since 2026-10-13).
• For photos and attachments, the previous version of a deleted or overwritten file is kept for 30 days (since 2026-10-14).
• Werp™ does not promise to restore data that users have deleted.

Exporting and deleting data

From the asset register screen, admins can export a list of units and a list by asset number as CSV. Stocktake results can also be exported as CSV. Bookings, check-out records and the activity history can be viewed on screen but not exported.

To stop using Werp™, an admin deletes the workspace in its settings. A workspace on a paid plan cannot be deleted, so cancel the plan under Billing & Plan first.

Thirty days after a workspace is deleted or a member is removed from a workspace, an hourly job deletes or anonymises their personal data (since 2026-10-18). It removes names, email addresses, profile pictures and any sign-in account that belongs to no other workspace. For a deleted workspace it also removes equipment photos, storage-location addresses and coordinates, booking titles and notes, the activity history and notifications.

Billing records are kept for the period required by law, and the name of a deleted workspace is kept in the operator's records. If the workspace still exists, the dates, equipment and status of bookings made by a removed member stay as business records, and the name shows as “Deleted user”.

Certifications and commitments Werp™ does not have

• Werp™ does not hold ISO/IEC 27001 (ISMS), the Japanese PrivacyMark, SOC 2 or ISMAP.
• There is no uptime guarantee (SLA). Article 9 of the Terms of Service states that the service may be stopped without prior notice for system maintenance and updates, failures and similar reasons.
• Support is by email to support@werp.in. There are no set support hours or response times.
• Werp™ makes no commitment on how or how quickly it notifies users of outages or security incidents.
• Payment is only by automatic charge after subscribing on Stripe's payment page. Paying by bank transfer against an invoice is not available.
• Rights to the data you register stay with you (Article 8 of the Terms of Service). If the service is discontinued, users are notified a reasonable period in advance (Article 10).