Shared identity, isolated workspaces, explicit approvals.
ProcessWorks uses the Lustra Studio account-security foundation, with separate workspace permissions, client records and integration controls.
Authentication
ProcessWorks delegates sign-in and account-security checks to the existing Lustra Studio authentication service. Passwords are not copied into a second ProcessWorks OS user table. Existing email verification, MFA, recovery and password-security rules remain part of the shared identity flow.
Workspace isolation
ProcessWorks operational records are scoped to a workspace and membership. The data model uses dedicated pw_-prefixed tables in the existing ProcessWorks operational database for workspaces, members, clients, connections, approvals, automations and audit events. This means the ProcessWorks OS can launch without modifying the Lustra Studio production database.
Marketplace connections
Marketplace connections are designed around provider OAuth rather than asking users to paste marketplace passwords into ProcessWorks. The current foundation records connection intent and metadata only; production token storage will be enabled provider-by-provider once the relevant OAuth application and secure server-side storage are ready.
Human approvals
High-impact commerce actions are designed around a prepare → review → execute → log model. This gives agencies the option to keep a human decision between an AI-generated recommendation and a marketplace change.
Auditability
ProcessWorks records workspace setup, client records, connection preparation and approval events in its own audit layer. These records show which user or process initiated a change and what happened afterwards.
Lustra Studio production protection
Lustra image-generation workflows, storage, billing records and authentication data remain separate from ProcessWorks commerce operations. ProcessWorks validates identity through the Lustra auth service while keeping its commerce workspace records in its own data layer.
Report a security, privacy or data incident
Send reports to [email protected] with the subject Security report. Include the affected ProcessWorks workspace or integration, a description of what you observed, the approximate time, reproduction steps where appropriate, and a safe way to contact you. Do not send passwords, OAuth tokens or other live credentials by email.
Reports are acknowledged, tracked internally, investigated for scope and impact, and kept open through containment and remediation. Where an incident affects customer or third-party platform data, ProcessWorks will use the applicable notification and escalation process for the affected service and will preserve relevant audit information needed to investigate the event.
Security contact
General security questions can also be sent to [email protected].