Your data. Your server. Your rules.
VirtualWorks is built on a simple principle: you should own your data and your systems, not rent access to them. Here's exactly how we protect your business and your customers.
SSL on every site · Code ownership · Daily backups · Data handling in our Privacy Policy
Three things we never compromise on.
You own your code
Every website we build is standard HTML, CSS, and JavaScript that lives on your server. No proprietary platform. No lock-in. If you ever want to leave, you take your site with you. No export fees, no restrictions.
Encryption everywhere
Every site we host runs on HTTPS with TLS encryption, enforced from the first request. SSL certificates are issued automatically and renewed before they expire. Plain HTTP is never allowed.
Data handling is explained
Chat messages and other information you submit are handled as described in our Privacy Policy. This includes AI processing, storage and access by our team and service providers.
How we secure the systems that run your business.
Web server security
All VirtualWorks-hosted websites run on dedicated virtual private servers with automated security patching, firewall rules restricting unnecessary ports, and fail2ban-style intrusion detection to block brute-force attempts. We don't run customer sites on shared hosting where one compromised account can affect others.
- TLS 1.2+ enforced, older protocols disabled
- Security headers on every response (X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy)
- HTTP Strict Transport Security (HSTS)
- Automated certificate renewal via Certbot
- Admin panels rate-limited and access-restricted
Data storage & backups
Chat messages and relevant contact details are stored as described in our Privacy Policy. Application secrets and API keys are managed as environment variables, never hardcoded into application code or committed to version control.
- Daily automated database backups with 7-day retention
- Website files backed up daily alongside database snapshots
- Backup scripts run at 2 AM server time, off-peak
- Database credentials never exposed in application code
- Separate credentials per service and per environment
How we handle AI conversation data.
When customers message your business through the AI chat widget on your site, here's exactly what happens to those conversations.
What we store
Chat messages and replies are recorded and stored to support conversations and follow-up. Our team may review this information. Recording, processing, storage and sharing are described in our Privacy Policy.
- Stored messages are associated with the relevant business account
- Authorized team members may review conversations
- Messages and conversation context are processed by Anthropic to generate replies
Processing and sharing
Anthropic processes chat messages and conversation context to generate replies. Team follow-up may involve message excerpts and contact details sent through Telegram. Retention and access are explained in our Privacy Policy.
- Chat processing by Anthropic
- Conversation review by authorized team members
- Follow-up alerts may include message excerpts and contact details
- Retention and access described in our Privacy Policy
Why ownership is a security feature.
Most website platforms create a single point of failure: if the platform gets breached, all customers' data is at risk. If the platform shuts down, all customers lose their sites. If the platform raises prices, customers are locked in with no leverage.
VirtualWorks is structured differently. Each client's website lives on isolated infrastructure. Your site's data doesn't share a database with thousands of other businesses. Your code isn't stored in a proprietary format controlled by a third party. A compromise of one client's environment doesn't cascade to others.
This also means if you ever want to stop using VirtualWorks, you take everything with you. Your site files, your domain, your customer data. All of it belongs to you. The same code-ownership philosophy that protects you from platform risk also protects you from vendor lock-in.
Built with privacy in mind from the start.
What we collect and why
We collect only what's needed to deliver your services: business information from your intake form, chat conversations with your customers, analytics events to understand site performance, and payment information processed through our payment provider (never stored on our servers).
We use information to provide the services and operate the website as described in our Privacy Policy.
Compliance readiness
Website analytics, advertising tools and chat data handling are described in our Privacy Policy. Our retired SMS program was TCR-registered and followed CTIA guidelines for opt-in, opt-out, and HELP responses while it was active.
- Privacy Policy available at /privacy/
- Historical SMS Terms available at /sms-terms/
- Data access and deletion requests are reviewed subject to legal obligations
- Analytics and advertising tools disclosed in our Privacy Policy
Questions or concerns?
If you have a security question, want to report a vulnerability, or need information for compliance purposes, reach out directly.
Email: david@virtualworks.ai
Response time: We respond to security inquiries within 24 hours on business days.
Vulnerability disclosure: If you discover a security issue with our systems, please email us privately before disclosing publicly. We take all reports seriously and respond promptly.