# Trust and data handling

> For the complete documentation index, see [llms.txt](https://workpods.ai/llms.txt)

WorkPods, an [AXO (agent experience optimization)](https://workpods.ai/axo) and [GEO](https://workpods.ai/geo) agency with SEO underneath, keeps client data in its own infrastructure. Access is role-based, every approval is logged, visitor IP addresses from server logs are never stored, and a data processing agreement (DPA) is available on request.

## Keep client data in our infrastructure under your control

Four controls cover where your data lives, who can see it and who signs off on changes. They apply to every GEO, AXO and technical SEO engagement.

1. Client data stays in WorkPods' own infrastructure: your workspace records, audit findings, drafts and cleaned log summaries are held there.
2. Access is role-based: permissions inside your workspace depend on each person's assigned role, separating who can view findings from who can approve changes.
3. Every sign-off goes into an approval log: nothing ships without your team's approval in our approval log, as shown on [how WorkPods works](https://workpods.ai/how-it-works).
4. A DPA is available on request: we provide a data processing agreement whenever your legal, privacy or procurement team asks for one.

## Verify agent logs without storing visitor IPs

WorkPods never stores visitor IP addresses from your server logs, and our test agent never submits forms or places orders on your website. Your team can measure AI agent traffic and test conversion flows without keeping personal IP data or creating fake CRM leads.

When [agent analytics](https://workpods.ai/axo/agent-analytics) reads Cloudflare (Worker or Logpush), Vercel log drains, or uploaded nginx and Apache logs, three rules apply:

- For Observed agent visits, each log entry is Verified inside published IP ranges, Mismatch outside them, or Unverified without published ranges.
- Coverage in days of logs received is always shown, and "no fetch observed in covered logs" is never stated as "never fetched".
- We discard the visitor IP address right after the range check and keep only daily totals plus cleaned log batches for 14 days.

When we test [agent-ready websites](https://workpods.ai/axo/agent-ready-websites), the agent runs 3 to 5 tasks your team confirms, such as finding pricing or booking a demo. It reads form labels and WebMCP markup (an emerging standard for browser-agent tools) and records the step where each task stopped. It never submits a form or buys anything, so no test lead or order reaches your systems.

## Share plain answers with your security and legal team

Your security or legal team can take the answers below straight into a vendor questionnaire. They cover six questions on data storage, log privacy, system access and certifications.

| Security or legal review topic | WorkPods' factual answer |
|---|---|
| Where is client data hosted and stored? | Client data stays in WorkPods' own infrastructure. |
| Do you store personal visitor IP addresses when analysing server logs? | No. We mark bot visits Verified, Mismatch or Unverified against published IP ranges, discard visitor IPs immediately, and keep only daily totals plus 14-day cleaned batches. |
| Can your AI agents modify our live website or CMS autonomously? | No. Operators review every draft and patch, and your team must approve every change in our role-based approval log before release. |
| Will your automated browser tests pollute our CRM or place real orders? | No. Each confirmed task ends Completed, Reached the confirmation step, Partial or Blocked, and our test agent never submits a form or buys anything. |
| What system access do you require for an initial evaluation? | None. The free audit requires only a work email and website URL, using public pages, site files and AI engines. |
| Do you hold SOC 2 or ISO certifications, or sign a DPA? | WorkPods holds no SOC 2 or ISO certification and claims none. A data processing agreement (DPA) is available on request. |

We never claim certifications or partnerships we do not have. You can judge our work before sharing any logs by requesting a [free GEO and AXO audit](https://workpods.ai/free-audit), which uses public data only.

## Questions buyers ask

### Where is our company and workspace data stored?

Client data, including audit findings, drafts and patches, stays in WorkPods' own infrastructure. Inside your workspace, access is role-based, so each person sees what their role allows. Every deliverable goes through the approval log, which shows your team what was proposed and who approved it.

### Do you store visitor IP addresses when we connect Cloudflare, Vercel or server logs?

No. Visitor IP addresses from your logs are never stored. Across Cloudflare, Vercel, nginx or Apache logs, we mark each bot request Verified, Mismatch or Unverified against published IP ranges and discard the IP immediately. We keep only daily totals and 14-day cleaned batches.

### Why do you keep cleaned log batches for only 14 days?

Keeping cleaned log batches for 14 days lets operators verify which pages AI agents fetched and spot HTTP errors or redirects served to bots. It also lets us report your exact log coverage in days received. After 14 days, only daily totals remain for trend reporting.

### Are you SOC 2 or ISO certified?

No. WorkPods does not hold SOC 2 or ISO certification and makes no certification claims. We state only the controls in place today: our own infrastructure, role-based access, an approval log, no visitor IP storage, and a DPA on request.

### Can we review and sign a Data Processing Agreement (DPA) before working together?

Yes. A data processing agreement (DPA) is available on request for your legal, privacy or procurement team to review before you start an engagement. You can also test our work first through the free audit without connecting log sources or sharing internal data.

### What access do we need to grant for the free GEO and AXO audit?

None. The free audit needs no system access, analytics credentials or server logs. The request form asks only for your work email and your website URL. Our operators check your public site files, HTML, forms and AI answer citations and send the report within 3 working days.

By Prateek Tomar · Reviewed by Shefali Munjal · Published 2026-10-30

---

Source: https://workpods.ai/trust · WorkPods, updated 2026-10-30