Every question, one honest answer

WRNexus is the WorkRoot platform shell — a production-grade identity, workspaces, RBAC, audit log and billing stack that drops into your product behind a single SDK. Instead of stitching together five vendors (auth, MFA, SSO, billing, audit) you wire up one platform on day one and inherit the same primitives across every product your team ships.

Engineering and platform teams shipping a multi-tenant SaaS who would rather buy a battle-tested identity + billing shell than rebuild one. Startups land on Starter, growing teams adopt Team for OAuth and RBAC, and regulated organisations move to Enterprise for SAML, SCIM, audit retention and contracts.

Most teams have signup, login, OAuth, MFA and a working dashboard wired in a single afternoon. Drop the SDK in, point it at your Starter workspace, copy the four-line session-guard snippet from /docs, and you are serving authenticated traffic from production before lunch.

Single-purpose auth vendors hand you tokens — you still own users, workspaces, RBAC, audit logs, billing and admin consoles. WRNexus ships those as first-class primitives on the same SDK, so a new product in your account inherits a workspace shell, a Customer Portal, a SOC 2-ready audit trail and a staff console on day one — not after a six-month build.

Every WRNexus service speaks TLS 1.3, and we encrypt sensitive fields (TOTP secrets, OAuth refresh tokens, API keys) with AES-GCM using a per-tenant key. Postgres backups are encrypted with the same scheme before they leave the VM. Passwords are hashed with Argon2id and checked against the HIBP k-anonymity API on signup and rotation.

Yes — both ship on the Enterprise tier. SAML 2.0 supports Okta, Microsoft Entra ID, Google Workspace and JumpCloud, with attribute mapping for role assignment. SCIM 2.0 covers user and group lifecycle, with deprovisioning propagating to every region within ~60 seconds.

WRNexus is SOC 2 Type II audited annually and ships ISO 27001 and GDPR controls out of the box. Enterprise customers get the latest SOC 2 report, a signed DPA, sub-processor list, and access to our shared-responsibility matrix for HIPAA-aligned deployments.

Yes. We engage an independent CREST-accredited firm for a full external pentest every twelve months and run a continuous public bug-bounty programme. Critical findings are remediated within 7 days and the executive summary of each pentest is available to Enterprise customers under NDA.

Detect → contain → notify within four hours of a confirmed incident, in line with GDPR Article 33. Customers receive a dedicated channel during the incident, a post-mortem within 10 working days, and a follow-up audit-log export so you can verify any actor activity in your tenant.

Yes — Enterprise customers can run the exact same container images we publish to the WorkRoot registry inside their own cloud account. Your data never leaves your perimeter, and you receive the same migrations and patch cadence as the managed service.

Yes. From Account → Workspace → Export you can download a signed ZIP containing your users, workspaces, memberships, audit log entries, and integration settings as JSON and CSV. Exports include cryptographic checksums so you can verify integrity downstream.

The managed service runs in EU (Frankfurt) and US (Virginia) regions by default, with optional Asia-Pacific (Singapore) on Enterprise. Workspace data is pinned to one region — we never replicate across regions without your explicit opt-in for compliance reasons.

Yes. A single WRNexus identity can be a member of any number of workspaces — personal, team, and partner — each with its own roles, billing and audit trail. Switching contexts in the Account UI is a single click and never requires a re-login.

From Account → Danger zone you can request workspace deletion, which begins a 30-day soft-delete window with full restoration available to owners. After 30 days, encrypted data is purged from primary storage and rolled out of backups within 90 days, per our data-deletion policy.