Skip to content

WING-193 — YC cloud security and privacy disclosures

Status: approved copy/design contract; UI locked until cloud capability reporting and tenant isolation exist. This document deliberately does not claim that planned controls are live.

Why this is spec-only today

The Angular app has no trustworthy edition/capability endpoint. Feature flags describe product features, not runtime storage, authentication, retention, encryption, or provider behavior. Rendering YC-cloud copy from a build-time flag or URL would risk showing cloud promises in the local desktop edition. The server scaffold also intentionally returns 503 for application APIs until a durable tenant-scoped repository exists.

UI implementation may begin only when an authenticated, server-derived capability document exists:

edition: desktop | yc-cloud | team-cloud
workspaceKind: guest | google-bound | seeded-readonly
audience: yc-reviewer | team-test
workspaceExpiresAt: timestamp | null
allowedRetentionDays: number[]
canKeepUntilDeleted: boolean
canExtendGuest: boolean
canDelete: boolean
canExport: boolean
credentialProtection: unavailable | planned | kms-per-tenant
loggingContentPolicy: unavailable | content-excluded
aiDispatch: unavailable | provider-disclosure-required

The client must render the server response; it must not infer these facts.

Reusable component

Proposed selector: app-security-disclosure.

Inputs:

  • context: onboarding | resume-upload | connection | api-key | ai-dispatch | export-delete
  • status: available | planned | locked
  • structured values supplied by the capability/API response, never interpolated from user content
  • AI dispatch additionally requires provider name, exact content categories, purpose, and whether the provider retains/trains under the selected account/API terms

Collapsed label: Security & privacy

Expanded sections, always in this order:

  1. Why we need this
  2. Where it is stored
  3. Who can access it
  4. How long
  5. Delete now

Status labels:

  • Available now — only after an executable test proves the control.
  • Planned — locked until available — designed but absent.
  • Not used in YC cloud — feature deliberately excluded.

Never use “military-grade,” “100% secure,” “anonymous,” “zero access,” “never,” or “only you” unless the precise technical statement has been independently verified.

Onboarding step

Title: Security & privacy

Intro:

Your review starts in an isolated guest workspace. Guest workspaces are planned to expire after 7 days unless you explicitly extend them. Optional Google sign-in is planned to bind the same workspace for cross-device access. These cloud controls are locked until tenant-isolated storage and sessions are available.

Rows:

Topic Copy Status today
Workspace “Your workspace and dataset must be isolated from every other reviewer and team tester.” Planned — locked until available
Guest retention “Guest data is planned to expire after 7 days. Extension must be explicit.” Planned — locked until available
Google binding “Optional Google sign-in will bind this workspace; it will not silently merge another workspace.” Planned — locked until available
App secrets “WorkWingman service secrets are injected from Google Secret Manager, not stored in the app image or source.” Available in server scaffold
Your credentials “OAuth tokens and user-supplied API credentials are planned to be encrypted per tenant with Cloud KMS.” Planned — locked until available
Third-party passwords “WorkWingman will not store third-party account passwords in the YC cloud edition.” Required launch policy; locked until cloud edition exists
Logs “Operational logs are designed to exclude profile, résumé, prompt, and generated-document content.” Planned — locked until verified logging sink exists
Control “You will be able to export your workspace or delete it immediately.” Planned — locked until available

Acknowledgement button: I understand the current limits

This acknowledgement records comprehension, not consent to unrelated processing and not a waiver.

Team-test retention variant

The YC default remains seven days. A code-only team-test workspace defaults to 30 days and offers exactly 1, 7, 30, or 90 days. The UI shows the resulting calendar deletion date before the user confirms.

Keep until I delete it appears only after the workspace is bound to an approved internal Google identity. Possession of the shared team entry code is insufficient. The server supplies canKeepUntilDeleted; the client must not infer approval from an email domain.

Users may explicitly shorten or extend within their allowed choices. Every change shows the old and new deletion date and records a content-free audit event. Page visits, API activity, code rotation, and sign-in do not silently extend retention.

Credentials and tokens are deleted with the workspace and can never outlive it. Provider expiry or revocation may make their lifetime shorter. The UI must show the earlier effective expiry without claiming WorkWingman can extend provider-issued credentials.

Seeded sample/test workspaces expose Reset sample workspace, not deletion or retention controls. Reset restores the reviewed seed deterministically and removes team-test activity from that workspace. Reset events and all team fixtures stay outside YC metrics.

Contextual disclosures

Résumé upload

Why we need this: “To extract facts you choose to use in your profile and tailored materials.”

Where it is stored: “Planned: your tenant-isolated workspace, encrypted by the durable storage service. The current YC cloud lane is locked and does not accept uploads.”

Who can access it: “Your workspace session and the services required for the action you request. It is not part of the seeded sample workspace.”

How long: “Planned: until guest expiry, your explicit extension, Google binding, or deletion.”

Delete now: “Delete the uploaded file and derived workspace facts.” Status: Planned — locked until available

Connections and API keys

Why we need this: “To connect a provider or call an API only when you choose that integration.”

Where it is stored: “WorkWingman app secrets use Secret Manager. Your OAuth tokens and API credentials require per-tenant KMS encryption; that control is not implemented yet.”

Who can access it: “The selected connector at request time. Possessing a YC or team entry code does not grant access to your credentials.”

How long: “Until you disconnect, delete the workspace, or the guest workspace expires.”

Delete now: “Disconnect and revoke the provider credential.” Status: Planned — locked until available

Third-party password note: “Do not enter a third-party account password. YC cloud will use OAuth, provider-issued tokens, or user-controlled browser handoff; password storage is not supported.”

AI generation — pre-dispatch confirmation

No prompt leaves WorkWingman until this disclosure is populated from the actual routing decision.

Template:

Send to {provider} to {purpose}: {content categories}.

The content list must use concrete categories, for example:

  • job description;
  • selected résumé facts;
  • selected career-story examples;
  • drafting instructions;
  • prior generated draft, if refinement was requested.

It must not say merely “necessary information.” The action buttons are Send and generate and Cancel. Provider retention/training language must link to the account/API terms actually in use; WorkWingman must not paraphrase a guarantee it cannot enforce.

Status today: Planned — locked until provider-aware dispatch confirmation exists

Export and delete

Why we need this: “So you can take your information with you or remove the workspace.”

Where it is stored: “The export is created for your download. Do not place exports in operational logs or the seeded sample.”

Who can access it: “Your active workspace session.”

How long: “Temporary export artifacts must be deleted after download or a short documented timeout. Workspace deletion revokes sessions and removes tenant records.”

Delete now: destructive confirmation names the workspace audience and explains that deletion cannot be undone. It must not require Google sign-in for a valid guest session.

Status today: Planned — locked until tenant deletion/export is implemented and tested

Placement

  • Onboarding: a dedicated step after private-code entry and before any upload/connection.
  • Résumé upload: directly beside the file chooser, before selection.
  • Connections/API keys: inside each connector card, before OAuth redirect or key entry.
  • AI generation: mandatory confirmation immediately before each external dispatch.
  • Export/delete: persistent Security & Privacy settings page plus a compact disclosure in the action dialog.

Do not hide these solely in terms, a footer, or a generic privacy-policy link.

Acceptance tests required before UI status changes

  • Desktop never renders YC-cloud claims.
  • YC and team editions render their correct audience without exposing an internal tenant ID.
  • Every contextual disclosure is keyboard- and screen-reader-accessible.
  • AI dispatch is impossible until provider and content categories are present.
  • A “planned/locked” control has no enabled action that implies it works.
  • Seven-day text comes from the server retention policy and displays the actual expiry timestamp.
  • Team code-only workspaces default to 30 days and expose only 1/7/30/90-day choices.
  • Indefinite team retention remains unavailable until an approved internal Google binding is server-verified; the shared code alone never enables it.
  • Retention changes show the exact deletion date and never occur implicitly.
  • Credential/token effective expiry is no later than workspace expiry.
  • Seeded test reset is deterministic and cannot contaminate YC metrics.
  • Google binding rotates the session and preserves the same workspace.
  • Cross-tenant API tests cover upload, read, export, deletion, connections, generated documents, telemetry, and guessed identifiers.
  • Operational-log tests inject canary profile/résumé/prompt/generated text and prove it is absent.
  • Delete revokes all sessions and verifies tenant records are gone.