How to deploy WorkSigned
WorkSigned is not cloud software. It's designed to operate with zero exposure of any sensitive data to external networks.
Overview
The core WorkSigned software operates completely on institutional networks. Only record fingerprints (hash sequences which do not contain any data or carry any real meaning) are sent to WorkSigned's servers for signing. No telemetry or sensitive data is ever collected. This is the minimal amount of external network interaction that can happen while using a 3rd party signing authority. In other words, there is zero chance for WorkSigned or any third party cloud to interact with user data.
How data privacy is achieved
No research data, files, or telemetry ever leave the network.
WorkSigned local client software. The researcher-facing desktop interface. The package is downloaded and runs locally on the researcher's machine of choice - usually an institutional issued laptop or workstation. This software only talks to institution-controlled machines, and NEVER sends data, telemetry, or other information outside of the institution's own networks.
WorkSigned local witness server. The institution installs this component onto their own servers. This server acts as a central relay to direct traffic: AI, email, and web search activity all occur via this relay. The purpose of the relay is to provide credibility to the record. The traffic passing through here is witnessed and signed, meaning that it cannot possibly be tampered with by the user. This makes the record robust as evidence in a legal setting. The relay submits the fingerprints only (without any data) to the external WorkSigned server for signing, so that WorkSigned may attest to the validity of the record.
WorkSigned remote signing servers. WorkSigned operates this server. Its only purpose is to sign incoming fingerprints and return it - it cannot and does not receive any other input of any kind.
The end result for the user
With this architecture, the user does not have to worry about data or knowledge being compromised. The institution can enforce its data policies easily since WorkSigned software provides no sanctioned code paths for violations.