WorkOS Security Review: A Complete Breakdown of SOC 2, Data Storage, and IP Allowlisting

When IT teams approve an SSO vendor, the security review is often the final gate. WorkOS, an API provider for enterprise SSO, has published an official security review document covering key questions such as SOC 2 compliance, data storage locations, and IP allowlisting. Based on that document, this article outlines the dimensions IT teams need to focus on most.

What SOC 2 Certification Means

WorkOS holds SOC 2 certification, one of the most common compliance thresholds enterprises look for when purchasing SaaS services. SOC 2 is issued by an independent auditor and examines whether a provider's controls are adequate across security, availability, processing integrity, confidentiality, and privacy.

For IT teams evaluating SSO solutions, a SOC 2 report can serve directly as starting material for vendor security assessment, reducing the workload of conducting your own audit. Note that SOC 2 is not a one-time certification—it requires periodic re-examination—so it's advisable to confirm during procurement that the report's coverage period is still valid.

SOC 2 reports come in two types: Type I and Type II. Type I only assesses whether controls are reasonably designed at a single point in time, while Type II examines the actual operating effectiveness of controls over a period (typically 6 to 12 months), making the latter more valuable to buyers. The report itself is subject to a confidentiality agreement and typically must be requested through WorkOS's trust center or sales channel. Additionally, among SOC 2's five trust services criteria, Security is the mandatory foundational category, while the other four (availability, processing integrity, confidentiality, and privacy) are optionally included in the audit scope at the provider's discretion—so during review you should confirm which criteria the report actually covers.

What Data Does WorkOS Store

In SSO scenarios, WorkOS needs to process enterprise directory information, user identity identifiers, and authentication sessions. The original document explicitly lists the scope of data WorkOS stores, which is the most direct basis for IT teams to assess data sensitivity.

From an integration-model perspective, WorkOS plays an identity coordination role in the SSO flow, connecting an enterprise's identity provider (IdP) with downstream applications. Understanding this helps determine which data passes through WorkOS and which remains in the enterprise's own systems. For organizations with strict data classification, we recommend checking each item against the original data list to confirm whether any data retention exceeds expectations.

Common standard protocols in SSO integration include SAML 2.0 and OpenID Connect (OIDC). SAML completes authentication by exchanging signed assertions between the IdP and the SP (service provider), while OIDC uses ID Tokens based on OAuth 2.0 to convey user identity. As an intermediary layer, WorkOS typically needs to persist organization and connection configurations, mappings of users' external identifiers, and session or token metadata—while users' original credentials (such as passwords) always remain with the enterprise IdP and never pass through WorkOS. Clarifying this protocol division helps determine data flows and minimize retention scope.

Data Residency and Compliance Boundaries

Where data is stored directly relates to cross-border data transfer compliance. The original document specifically explains where WorkOS data is located, which is especially critical for enterprises bound by GDPR or other regional data regulations.

During review, IT teams should map data residency information against their own compliance requirements. If an enterprise requires that user identity data must not leave the country, it needs to confirm whether WorkOS's storage region satisfies this constraint, or evaluate whether alternative deployment options exist.

Compliance determinations for cross-border data transfers depend not only on where data is "stored" but also on whether foreign entities can access it during transmission and processing. Under GDPR, data transfers must rely on legitimate mechanisms such as adequacy decisions, Standard Contractual Clauses (SCCs), or Binding Corporate Rules; following the EU Court of Justice's Schrems II ruling, transfers to the US also require an additional transfer impact assessment. Therefore, when reviewing WorkOS you should confirm its storage region, backup region, the locations from which support staff access data, and the transfer safeguard mechanisms in place—not just a single storage location.

IP Allowlisting: An Extra Layer of Network Defense

Beyond application-layer authentication mechanisms, WorkOS also offers an IP allowlisting mechanism that lets enterprises restrict which IP addresses can access its services. The original document lists the IP ranges that need to be allowed, giving operations teams configuring firewall rules and network access control lists (ACLs) a ready-to-use operational checklist.

The value of IP allowlisting lies in adding a layer of network perimeter defense: even if credentials are compromised, requests from unauthorized networks will be blocked. We recommend incorporating these IP ranges into network planning early in deployment to avoid SSO flow failures caused by firewall blocking after go-live.

Practical Recommendations for the IT Approval Process

Based on the above, IT teams approving WorkOS can proceed in the following order: first obtain the SOC 2 report to confirm compliance status, then assess data sensitivity against the data storage list, then verify whether the data residency region meets compliance requirements, and finally incorporate the IP allowlist into network configuration. This process covers the three dimensions of compliance, data, and network, and can fairly completely address common questions in a security review.

The practical value of WorkOS's document is that it consolidates security information scattered across multiple documents, reducing the information-gathering cost for IT teams during vendor evaluation. For organizations advancing SSO integration, it can serve as baseline material for security review.

One-line Summary

A breakdown of WorkOS security review essentials: SOC 2, data scope, data residency, and IP allowlisting.

Paragraph Summary

Based on WorkOS's official security review document, this article outlines key review dimensions for IT teams approving an SSO vendor. WorkOS holds SOC 2 certification, which can serve as starting material for vendor security assessment, though the report's coverage period should be confirmed as valid. The article emphasizes checking the scope of data stored to determine which data passes through WorkOS and which remains in enterprise systems; data residency affects cross-border compliance and should be mapped against applicable regulations; IP allowlisting provides network-layer protection, and the IP ranges listed in the original document can be used directly for firewall configuration. Finally, it offers an approval process that proceeds through compliance, data, and network layers in sequence, helping IT teams systematically address common security review questions.