Documentación de woku - Guía para desarrolladores

Woku is designed for enterprise customers that require auditable controls over who accesses the platform, what they do, and how information is protected. This section documents the concrete controls in operation.

Capabilities overview

Capability	Status	Page
Authentication with persistent session + idle timeout	✅ active	Authentication
Per-user TOTP MFA (opt-in)	✅ active	MFA
Active sessions visible + revocable by the user	✅ active	Sessions
Per-company audit log with CSV export	✅ active	Audit log
Anti brute force lockout + email notification	✅ active	Anti brute force
Security HTTP headers (HSTS, CSP nonce, etc.)	✅ active	Headers and CSP
Per-company IP allowlist (CIDR IPv4 + IPv6)	✅ active	IP allowlist
Enterprise SSO (SAML 2.0 + OIDC via Stytch)	✅ active	SSO
Secrets management (SSM Parameter Store + KMS)	✅ active	Secrets management
AES-256-GCM encryption at rest + HMAC-SHA256 signatures	✅ active (document signing opt-in per company)	Encryption and signatures

Principles

Defense in depth: each layer has its own protection (transport with HSTS, routing with CSP, session with idle timeout, account with anti brute force, sensitive actions with MFA).
Auditability: every critical action (login, company changes, CRUD on wokus and forms, etc.) is logged with actor, IP, user-agent, and timestamp.
Encryption at rest: sensitive secrets (TOTP secrets, integration tokens) are stored encrypted with AES-256-GCM.
Least privilege: MFA backup codes are bcrypt hashes; refresh tokens are rotating and single-use.

How to report a vulnerability

Write to team@woku.app with the details. We respond within 24 business hours, or according to the SLA agreed in your Corporate contract.

​Capabilities overview

​Principles

​How to report a vulnerability

Capabilities overview

Principles

How to report a vulnerability