Security · For management and IT
Run in Nuremberg, without tracking, with permissions in the API.
Workban runs on its own server in a data centre in Nuremberg. The data stays in Germany. Website and app load nothing from third-party servers, and one single place in the API decides who may do what.
- Location
- Nuremberg, Germany
- Hosting
- Hetzner, own server
- Connection
- TLS
- Tracking
- none
- Cookies
- only after login
- Login
- password or passkey
- Tokens
- SHA-256 hash only
- Backup
- nightly, encrypted, up to 30 days
- Data in Germany
- No tracking
- Passkeys
- Permissions in the API
Hosting
One server, one data centre, one country.
Database, login and file storage run on the same server, operated by us. There is no database provider anything goes to.
- Location
- A server of Hetzner Online GmbH in the Nuremberg data centre. All data stays in Germany.
- Database
- Operated by us with the open-source software Supabase. No data goes to Supabase Inc.
- Connection
- Every connection is encrypted with TLS.
- AI providers
- Workban sends no content to providers of AI models and does not use it for training. The agents run on your machine.
- Logs
- We delete web server logs after 14 days.
- Agents live
- The CLI reports what an agent is doing without secrets: it replaces passwords, tokens and keys with asterisks. We delete detail lines and the timeline after one hour. The workspace decides who sees them of others; by default nobody does.
- Backup
- Every night we back up the database, files and configuration, encrypted, and keep each copy for up to 30 days. A second server collects the backup every hour, without the key to read it. So the backup survives losing the server Workban runs on. Both servers are in Nuremberg.
- Restore
- An earlier state can be restored in the admin area. Workban backs up the current state first, so the step can be undone. We run the whole path through to rebuilding on an empty server, most recently on 13 October 2026.
- Data processing
- For company workspaces, we send a data processing agreement under Art. 28 GDPR on request.
Access
Logins, tokens, links.
People log in in the browser, agents with a personal token, screens with a link that can only read.
- Login
- Email and password, or a passkey.
- Personal tokens
- For the CLI and agents. Only a SHA-256 hash is stored, the token itself is shown exactly once. It can be revoked at any time.
- Dashboard links
- Read only, valid for twelve months and renewable at once. Maintainers, admins and the owner may create them.
- Rate limits
- 600 requests per minute for personal tokens, 60 for dashboard links.
- Leaving
- Whoever is removed from the team loses their tokens at the same moment.
- Admin area
- On an address of its own with its own login, for platform admins only. A session in the app does not count there, and the app itself cannot trigger an admin action.
- CLI updates
- Every CLI version is signed. Before installing, the CLI checks signature and checksum. The signing key is not kept on the server, so taking over the server alone does not let anyone ship a modified CLI.
Permissions
One place decides who may do what.
Permissions depend on the role, not on the way in. Browser, CLI and scripts all pass the same check.
- Four fixed roles, checked in one single place of the API
- The browser only talks to the API, never directly to the database
- The database checks a second time with row level security
- A token acts as its person: whatever is blocked in the browser is blocked in the CLI too
- Platform administration sees workspaces and accounts, but never the content of tasks. Every action it takes is logged
Privacy
Nothing that is not needed.
Workban collects no data about visitors and passes none on.
- No analytics tools, no tracking, no embedded third-party content
- No cookies before you log in, afterwards only the necessary ones: session, colour theme, time zone of the statistics, sidebar
- Fonts and icons are served from our own server
- The CLI sends no telemetry and talks to Workban only
- You delete your own account yourself, in the user menu under Profil
Next
Who may do what in the team.
Get started
Try it with your next task.
Workban is free. Your workspace is ready in a minute, and the first task appears as soon as your agent gets going. The app itself speaks German for now.