Information Security
Last updated: September 2026
lesswork designs and operates AI voice, messaging, workflow, and automation systems for production business use.
Our security approach is based on a simple principle:
Production AI should be controlled, observable, recoverable, and governed — not merely functional.
Cloud-first architecture
lesswork services are built using professional cloud and communications infrastructure rather than customer data stored on local office systems.
Our architecture may use specialist providers for AI processing, telephony, messaging, hosting, databases, integrations, and monitoring.
Provider selection depends on the technical, security, privacy, geographic, and operational requirements of the relevant deployment.
Access control
Access to production systems and customer data is restricted according to operational need.
Controls may include:
- individual user accounts;
- multi-factor authentication;
- role-appropriate permissions;
- least-privilege access;
- controlled secrets management;
- separation of production and test resources where appropriate.
Encryption
We use encrypted communications for data in transit.
Stored information is protected using the security mechanisms provided by the relevant production infrastructure, including encryption at rest where supported and configured.
We do not describe our architecture as universally “end-to-end encrypted” because different voice, AI, telecommunications, and workflow components necessarily process information at different stages of a transaction.
Production change control
lesswork treats customer-facing AI systems as production systems rather than casual software configurations.
Our production discipline includes, where appropriate:
- controlled development and release processes;
- separation of test and production states;
- source-controlled configuration and workflow artifacts;
- regression testing;
- structured payload validation;
- deployment verification;
- rollback planning;
- controlled vendor configuration changes;
- audit and diagnostic evidence.
AI workflow governance
Our systems are designed around bounded operational workflows.
Depending on the use case, this may include:
- explicit conversational guardrails;
- structured data capture;
- deterministic routing;
- human escalation;
- prohibited-action rules;
- knowledge-base boundaries;
- controlled external tool access;
- automated evaluation and QA.
The goal is not simply to make an AI agent answer questions. The goal is to make its operational behavior testable and governable.
Data minimization and retention
We aim to configure deployments so that they collect and retain only information needed for their operational purpose.
Retention requirements vary by use case. Where supported, deployments can be configured with reduced retention, disabled recording, shortened storage periods, or other controls appropriate to customer requirements.
Monitoring and diagnostics
Production systems may use technical logs and diagnostic information for:
- fault investigation;
- security;
- delivery monitoring;
- integration verification;
- service reliability;
- operational support.
Diagnostic systems should avoid unnecessary exposure of secrets or sensitive data.
Incident response
lesswork maintains procedures for identifying, investigating, containing, and responding to security and operational incidents.
Where an incident involves personal data, notification obligations are handled in accordance with applicable law and the relevant contractual relationship.
Third-party infrastructure
Production AI necessarily depends on external infrastructure.
We therefore treat third-party dependency management as part of system design rather than pretending such dependencies do not exist.
Our deployment approach considers:
- provider security capabilities;
- privacy and data-processing terms;
- operational resilience;
- geographic requirements;
- service limitations;
- fallback and escalation requirements;
- the effect of provider changes on production systems.
Customer-specific requirements
Security, retention, hosting, recording, data residency, regulated-use requirements, and other controls can vary materially between deployments.
Where a customer requires specific contractual or technical controls, these must be agreed as part of the applicable deployment scope.
Questions
For security or privacy enquiries: