How Workbloom keeps you safe

Before anything reaches a client (a reply, a proposal, an offer or an invoice) Workbloom shows you the platform, the recipient and the exact full text. It goes out only when you confirm that specific item.

If the text changes after you looked at it, the send is refused and you're asked to review it again. On Fiverr, Workbloom never sends, delivers or submits anything: it copies your text, or fills one box when you click, and you press Send, Deliver or Submit offer on Fiverr yourself.

• Autopilot can prepare drafts, reminders and follow-ups, but bids, marketplace replies, client emails and invoices always wait for your OK.
• Spending limits, quiet hours and your working hours apply to everything it does.
• One Pause all switch stops every automated action immediately.

Fiverr has no seller API, and its rules forbid scraping and bots, so Workbloom doesn't do either. Every way in is one you drive: Fiverr's own Earnings CSV, entries you type, or the notification emails Fiverr sends you. The optional browser extension is off until you switch it on, after a plain note about the risks. It only reads Fiverr pages you open yourself, in the tab you opened, reads nothing in a background tab, and never clicks, navigates, polls, opens pages or presses Send. It fills one text box, and only when you click its chip. For marketplaces that offer an official connection, Workbloom uses that.

You sign in on Fiverr's own page, and Workbloom never asks for that password. For marketplaces that give Workbloom limited access instead, the access keys are encrypted at rest in Supabase's vault, readable only by the server, and deleted when you disconnect.

• Every database table uses row-level security: a workspace can only ever read and write its own rows.
• Uploaded files sit in private storage and are shared only through short-lived links.
• Everything travels over HTTPS, and the app can't be embedded in other sites.
• Email addresses, phone numbers and usernames are removed from text before it goes to an AI service.
• Fiverr usernames, messages and review text never appear on public pages.

Project, invoice and profile links for direct clients use long random tokens that are stored only as a fingerprint. Each link shows only what you chose to share, can expire, can be turned off at any time, and is hidden from search engines. Workbloom makes none of them for Fiverr buyers, because Fiverr requires that all business with them stays on Fiverr.

There are no Workbloom passwords to leak. You sign in with a one-time link or code sent to your email, and, once they are switched on, with Google or a passkey on your device. You can sign out of every device at once from Settings › Security.

Every action, by you, a teammate or Autopilot, is written to your activity log with the reason, and most can be undone in one click.

If you think you've found a security issue, please tell us privately before sharing it, and include enough detail to reproduce it. See also our Privacy page.