Strong per-tenant data isolation, encryption at rest, and — when you bring your own KMS keys — encryption boundaries COWE operators cannot cross.
Tenant secrets and workflow data are encrypted at rest with AES-256-GCM. On plans that enable an external KMS (AWS KMS, Azure Key Vault, or HashiCorp Vault), your data encryption key is wrapped by a key COWE never stores — so the platform cannot decrypt your data without your KMS. Deployments that don't configure an external KMS use a platform-managed key instead.
To support GDPR "Right to be Forgotten" and POPIA retention limits, organizations using their own KMS can revoke the wrapped data encryption key via API. Once the key is revoked, encrypted historical records and archives can no longer be decrypted.
COWE delegates user authentication and role authorization to ZITADEL via OpenID Connect (OIDC). Production deployments require JWT audience validation, so the API only accepts tokens issued for this application and rejects tokens minted for other clients.
Every organization's workflows, definitions, secrets and audit logs are partitioned by tenant and enforced with database-level query filters, so one organization can never read or act on another's data. Workflow execution runs in a scope bound to the owning organization, and role-based access control (Owner / Admin / Editor) governs who can deploy, run, or view sensitive execution data.
Every workflow records a step-by-step audit log — what ran, when, with which inputs and outcome — and human approvals are captured for non-repudiation. A data-retention worker enforces configurable retention windows so records don't accumulate indefinitely, and Enterprise plans can stream security events to their own SIEM (Splunk, Datadog and similar) for independent monitoring and long-term archival.
COWE is built to help you meet data-subject obligations. Personal data flowing through a workflow can be redacted from an instance on request, historical records fall under your configured retention policy, and organizations using their own KMS can crypto-shred — revoking the wrapped data-encryption key so encrypted data becomes permanently unrecoverable — to satisfy erasure requests.
For strict data-residency requirements, COWE can run entirely inside your own environment — on-premise or in your private cloud — so operational data never leaves your infrastructure. Your workflow logic is stored as standard BPMN 2.0 XML that you own and can export at any time; there is no proprietary lock-in on the format your business processes are written in.