Skip to content
WrkLst
Log inStart free trial
Security & data

Security, hosting and data ownership.

Security is our top priority. All data is encrypted, both on its way to you and where it is stored, with each WrkLst account having its own dedicated database and secure file storage structure — on Hetzner servers in Germany, with redundant infrastructure in Finland and Switzerland.
Start free trial
Hosting

Where your data is hosted

After extensive research into cloud providers, we chose Hetzner — one of Europe’s most established data center operators — for its reliable European infrastructure.
Hetzner, Germany
The WrkLst Service runs, and the data is stored, primarily on servers of Hetzner Online GmbH in Germany, with redundant infrastructure at Hetzner in Finland and at Infomaniak in Switzerland.
Used around the world
Where your data is stored says how it is protected, not where you may work from. Galleries, studios and collections around the world use WrkLst: a request from New York to our servers and back takes about a tenth of a second, from Tokyo about a quarter, and the apps for iPhone, iPad and Android work offline.
What European hosting means for you
The GDPR protects data by where it is processed, not by where the people it belongs to live. Because your processor is a German company, it covers everything you entrust to us, whether you work in Berlin, New York or Hong Kong: a data processing agreement, encryption, a database of your own, current backups and updates, and our duty to tell you without delay should anything ever go wrong. The European Commission recognises Swiss data protection law as equivalent.
No US company holds your records
The US CLOUD Act lets US authorities demand data from American providers, wherever that data is stored. Your works, contacts and documents are stored only by European companies — Hetzner in Germany and Finland, Infomaniak in Switzerland — and every service that processes them is European too. The only US company WrkLst itself works with is Stripe, for your subscription billing, and it never sees your records. Integrations you switch on yourself, such as QuickBooks or Google Workspace, send data where you direct it.
Renewable energy
By Hetzner’s own account, its German data centres run on 100% renewable electricity and its Finnish park on renewable energy since it was built in 2018; Infomaniak in Switzerland, by its own account, runs on 100% renewable electricity.
Encryption
All data is encrypted, both on its way to you and where it is stored.
A database per account
Each WrkLst account has its own dedicated database and secure file storage structure.
Access
Passkeys, two-factor authentication and strong password policies protect every sign-in, and role-based access controls decide, down to a single field, what each team member may see.
Backups
We perform regular system updates, backups and encrypted data transfers to ensure your information remains safe.
Updates
Our servers are continuously updated with the latest security fixes.
AI
AI does the data entry for you: WrkLst reads the works out of a PDF, a scan or pasted work details and hands you finished records to approve. AI in WrkLst is optional and switchable — it runs only in features that say so, never in the background. What AI does in WrkLst.
Who can see what

Permissions down to a single field

Each role defines what a team member may see and do. Prices, confidential prices, values (acquisition and insurance) and confidential notes are separate permissions, and a captions-only role sees the work and its caption without any price.

New team members are always invited and set up their own sign-in, and you can deactivate or reactivate them at any time. Admins also decide per role who may sync the address book or connect other software.

  • Roles & permissions
  • Prices
  • Confidential prices
  • Acquisition prices
  • Confidential notes
  • Captions only
  • Invite only
Roles as a way of working together
Version history

Every change, on the record

Every work and contact keeps its full change history, and an administrator can open “What changed” on any entry to see the old and the new value side by side. Records deleted by mistake can be recovered within seven days, and the history shows who restored them.

When a colleague is already editing a record, WrkLst shows that it is in use, so you cannot overwrite each other’s work. An interaction log also lets an admin follow every request made to the account — by day, channel and user, on a map of where it came from.

“Keeps track of all actions, sales etc.”
Patrick M. · ArchivistA real review from one of our customers on Capterra· 2018
  • Version history
  • What changed
  • Recover deleted records
  • Record locking
  • Interaction log
Signing in

Sign-in security

We enforce strong password policies and login protections to safeguard your account, with passkeys and two-factor authentication available.
Passkeys
Sign in with a passkey instead of a password.
Two-factor authentication
Add a second factor to your sign-in.
One-time codes
Sign in with a one-time code sent by email.
One sign-in for all your accounts
If you work across more than one WrkLst account, one email and one password sign you in to all of them, and you switch between them from the menu under your name.
How long you stay signed in
Right after you sign in, WrkLst asks once whether to stay signed in on this device or to end the session automatically when you stop working. Choose “this session only” on a shared computer.
Signing out
Signing out ends your session on the computer you are using — every WrkLst account open in that browser — and only there.
A password reset disconnects devices
When you choose a new password through the reset email, you can also disconnect your apps and devices: this signs the WrkLst app out on every iPhone, iPad and Android device and ends your personal access keys and address book connections — useful when a device is lost.
A security check
Settings › Security scores how well your account is protected and lists what to look at — people who no longer use WrkLst, sign-ins without a passkey or authenticator app, sign-ins from unexpected countries, unused API tokens and app connections, what AI assistants do in your account, presentation links public for a long time — each with what to do. Alerts tell you of new findings by email.
Who owns WrkLst

Independent, and in Berlin.

WrkLst is built and run by WL Artworld Solutions GmbH, Berlin — an independent company with no outside investors. The people who built it still run it.

The data you enter into WrkLst belongs to you. In addition to everyday exports like spreadsheets, PDFs and Word documents, your entire WrkLst database can be downloaded as one complete file (SQL dump) whenever you like — every record, in a standard format any database specialist can open — and every image and document you put in, complete and at full resolution.

That is our guarantee — 100% no data lock-in: a full export, any time, from your own settings and without asking us, so should you ever leave, nothing stays behind.

About the company

Frequently asked questions

Ready to elevate your workflow?

Start free trial