Public site and private application are separated
The public WorkReport website is designed for product information and educational resources. Private worker records are handled through the separate authenticated client application.
Keeping those roles distinct reduces unnecessary exposure of private application functionality on the marketing site.
Evidence belongs outside normal public browsing paths
Sensitive uploads should not be exposed as ordinary public web files. WorkReport uses protected storage outside the public document root and permission-checked application endpoints for private evidence.
The objective is to make authorization part of the file-access path rather than depending on an obscure URL.
Integrity and history matter
Preserved evidence and finalized records can use cryptographic fingerprints to help identify later changes.
Important record actions should preserve history rather than silently rewriting source material.
Security claims should stay realistic
No internet-connected software should be presented as impossible to breach. WorkReport uses layered controls and continues to undergo hardening, authorization testing, backup planning and review as development progresses.
Security documentation should describe actual controls rather than promises the system cannot guarantee.