Account security

Last updated: October 20, 2026

This page explains in plain language how Workes protects worker and employer accounts, what we do not guarantee, and what you can do yourself. Each item under “What we guarantee” and “How we protect it” is checked by automated tests that run whenever our code changes.

What we guarantee

A worker account can never open the employer cabinet or employer data. Whether an account is an employer account is decided by our own records, not by anything the account holder can edit.
Signing in to the employer cabinet requires both the account password and a code sent by SMS to the phone number on the account.
Only a session that has passed both checks on our servers can open the employer cabinet. That permission belongs to that one session, expires on its own and ends when you sign out.
The employer sign-in and password recovery screens answer in the same way whether or not an account exists.
Employer registration does not tell anyone who cannot receive codes on a phone number whether that number is already used by another account.
After an employer password is reset, sign-in is temporarily closed and an email is sent to the account address. It contains a link that locks the account at once if it was not you; only our team can unlock it.
Changing or resetting an employer password signs the account out of the employer cabinet on every device.
The phone number and email address of an employer account cannot be changed from inside the account, and a session that has proven only one of the two checks cannot change the password.
The phone number of an employer account can be changed only by our support team, after checking the identity of the company and its representative. The change ends access to the employer cabinet on every device, and the account holder is told by email.
Deleting one of your accounts, worker or employer, never deletes or changes the other.
Every SMS with a code reminds you never to share it and that Workes will never ask you for it.

How we protect it

Access to employer data is checked by the database itself, not only by the website, so going around the website does not go around the check.
Each worker's profile, documents, applications and notifications are protected by the database itself: one worker's account cannot read or change another worker's data.
The number of attempts to enter a code is limited.
Sign-in codes that Workes creates, and each step of employer sign-in, work only once and only for a short time.
Each employer code works only for the sign-in or recovery request it was sent for, and the database refuses it for anything else.
Sign-in codes that Workes creates are never stored in readable form in our systems.
Every SMS we send passes automated checks against abuse before it leaves.
Sending an SMS code and signing in on the employer sign-in form both require an automatic check that a person, not a program, is doing it.
The employer cabinet and employer sign-in work only on their own separate site address; the main site does not serve them.
Our site tells browsers to connect to it only over an encrypted connection.
If you report a lost or stolen phone, our support team can block sign-in to your account, for worker and employer accounts alike.

What we do not guarantee

Someone who has your phone or your phone number (because it was stolen or lost, or a SIM card was reissued to someone else) can receive your codes and confirm sign-in or recovery as you. We cannot tell them apart from you, which is why keeping your phone and SIM under your control is your responsibility under the Terms of Service (for employer accounts, also under the service agreement).
If you share a code with anyone, they can use it.
If your own phone or computer is infected with malicious software or compromised, we cannot protect what happens on it.
We cannot guarantee services outside our control: your mobile carrier, your email provider and other third parties.

Your responsibilities

Use a screen lock on your phone and a SIM PIN.
Never share a sign-in code. Workes will never ask you for one, not by phone, not by message and not by email.
If your phone or SIM card is lost or stolen, or your number stops working unexpectedly, tell our support and your mobile carrier at once. After checking that the request comes from you, we will block sign-in to the account.
Keep your email account secure: security notices for employer accounts are sent there.

The full rules are in the Terms of Service, section “Accounts”, and for employer accounts also in the service agreement.

Report a problem

If you think someone has accessed your account, or you have found a security problem on Workes, write to us. Please do not include codes or passwords in your message. info@workes.co.il

What we guarantee

A worker account can never open the employer cabinet or employer data. Whether an account is an employer account is decided by our own records, not by anything the account holder can edit.

Signing in to the employer cabinet requires both the account password and a code sent by SMS to the phone number on the account.

Only a session that has passed both checks on our servers can open the employer cabinet. That permission belongs to that one session, expires on its own and ends when you sign out.

The employer sign-in and password recovery screens answer in the same way whether or not an account exists.

Employer registration does not tell anyone who cannot receive codes on a phone number whether that number is already used by another account.

After an employer password is reset, sign-in is temporarily closed and an email is sent to the account address. It contains a link that locks the account at once if it was not you; only our team can unlock it.

Changing or resetting an employer password signs the account out of the employer cabinet on every device.

The phone number and email address of an employer account cannot be changed from inside the account, and a session that has proven only one of the two checks cannot change the password.

The phone number of an employer account can be changed only by our support team, after checking the identity of the company and its representative. The change ends access to the employer cabinet on every device, and the account holder is told by email.

Deleting one of your accounts, worker or employer, never deletes or changes the other.

Every SMS with a code reminds you never to share it and that Workes will never ask you for it.

How we protect it

Access to employer data is checked by the database itself, not only by the website, so going around the website does not go around the check.

Each worker's profile, documents, applications and notifications are protected by the database itself: one worker's account cannot read or change another worker's data.

The number of attempts to enter a code is limited.

Sign-in codes that Workes creates, and each step of employer sign-in, work only once and only for a short time.

Each employer code works only for the sign-in or recovery request it was sent for, and the database refuses it for anything else.

Sign-in codes that Workes creates are never stored in readable form in our systems.

Every SMS we send passes automated checks against abuse before it leaves.

Sending an SMS code and signing in on the employer sign-in form both require an automatic check that a person, not a program, is doing it.

The employer cabinet and employer sign-in work only on their own separate site address; the main site does not serve them.

Our site tells browsers to connect to it only over an encrypted connection.

If you report a lost or stolen phone, our support team can block sign-in to your account, for worker and employer accounts alike.

What we do not guarantee

Someone who has your phone or your phone number (because it was stolen or lost, or a SIM card was reissued to someone else) can receive your codes and confirm sign-in or recovery as you. We cannot tell them apart from you, which is why keeping your phone and SIM under your control is your responsibility under the Terms of Service (for employer accounts, also under the service agreement).

If you share a code with anyone, they can use it.

If your own phone or computer is infected with malicious software or compromised, we cannot protect what happens on it.

We cannot guarantee services outside our control: your mobile carrier, your email provider and other third parties.

Your responsibilities

Use a screen lock on your phone and a SIM PIN.

Never share a sign-in code. Workes will never ask you for one, not by phone, not by message and not by email.

If your phone or SIM card is lost or stolen, or your number stops working unexpectedly, tell our support and your mobile carrier at once. After checking that the request comes from you, we will block sign-in to the account.

Keep your email account secure: security notices for employer accounts are sent there.