{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-09", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "tool": { "slug": "worklio", "name": "Worklio", "vendor": "Worklio, Inc.", "vendorUrl": "https://www.worklio.com", "kind": "http-api", "category": "payroll", "summary": "Embedded US payroll from Worklio, Inc. for software platforms, PEOs and payroll bureaus. A partner's backend creates companies and workers, runs payroll in steps and reads tax forms through a REST API, with white-label screens as an alternative.", "url": "https://www.anchorterminal.com/tools/worklio", "markdownUrl": "https://www.anchorterminal.com/tools/worklio.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/worklio.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/worklio.json", "license": "Proprietary service. The public Terms of Use date from 2014 and the partner agreement isn't public. The front-end library sits in a private repository", "transports": [ "http" ], "remoteUrl": "https://api.worklio.com", "packages": [], "auth": "oauth", "authNotes": "Every call takes a bearer JWT from `POST https://api.worklio.com/connect/token`. In the sandbox a developer registers at apiweb.worklio.com/RegisterDeveloper and uses the password grant with the account's username and password, scope `api`, and a client secret the docs print and describe as shared by all sandbox users. Tokens last 24 hours. Browser apps use an OpenID Connect redirect flow through `@worklio/sdk`, which isn't published and is requested from support. Production credentials, single sign-on and allowed origins are set up by Worklio. A System user has full rights over every company it created. This is embedded-payroll partner access, with no route into an employer's payroll account elsewhere.", "pricing": "paid", "pricingNotes": "A partner's price is set in its agreement and isn't public. The partner pages publish retail list prices per person per month ($10 for Full-Service Payroll, $81 for all 19 modules) and call them illustrative, not a quote, with base, setup and per-use fees excluded. The sandbox is self-serve after developer registration, so an agent's owner can start without a contract. Whether registration asks for a card was not read, because apiweb.worklio.com disallows crawlers (checked 2026-10-09).", "priceSummary": "Paid", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs index, the reference pages read or the website (checked 2026-10-09).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-09" }, "docsUrl": "https://apidocs.worklio.com/docs/overview", "llmsTxt": "https://apidocs.worklio.com/llms.txt", "capabilities": [ "payroll.run", "payroll.embedded", "payroll.employees", "payroll.tax-filing", "payroll.contractors" ], "tags": [ "hosted", "closed-source", "oauth", "openapi", "llms-txt", "webhooks", "sandbox", "partner-access", "soc2", "iso27001" ], "lastRelease": "2026-06-30", "graded": true, "anchor": { "graded": true, "score": 38.6, "grade": "E", "agentReady": false, "rank": 812, "ranked": true, "rankOf": 842, "categoryRank": 10, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 44, "maintenance": 25, "payments": 25, "reliability": 25, "schema": 71, "security": 48, "transparency": 48 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 25, "points": 5, "reason": "Read with the hosted rubric, for embedded-payroll partner access. status.worklio.com exists and asks for a password, so there is no public status page (0) and no readable incident history (5). No rate limits were found in the docs index or the guides read (0). No 429 or backoff guidance and no idempotency keys. The reference says starting a scheduled payroll twice returns the same run, and that bonus, off-cycle, void and termination starts are not idempotent (5 of 15). The security page says the Service Level Agreement targets 99.9 per cent availability, with no SLA document or credits published (5 of 10). The API is in production use and not marked beta (10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 71, "points": 11.54, "reason": "Each of the 853 reference pages embeds an OpenAPI 3.0.4 fragment with schemas and the bearer scheme. No single downloadable spec was found (20 of 25). llms.txt and a Markdown copy of every page (10). 821 of 853 operations carry a description, and many state which user levels may call them and in which run state (14 of 20). Inputs are typed with formats and required flags. Enums are integers whose meanings sit in description text (10 of 15). The quick-start guides give curl, Node.js and Python examples with 400 responses, while the two reference pages sampled document only a 200 (7 of 15). An `api-version` header and a changelog with two entries, both dated 30 June 2026 (10 of 15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 44, "points": 7.15, "reason": "No field selection, and the pagination guide says most `/wep` endpoints return their full result set on every call (8 of 25). The `/api/public` endpoints take `limit`, `skip`, a filter language with 18 single-field operators and multi-field sorting, with a page token that expires after 60 seconds (12 of 20). Errors share one envelope with a code and per-field validation errors, but the Run Payroll guide tells callers to read an HTTP 500 with an untranslated message as the cue to finalise, and `errorCode` is null in that example (9 of 20). No idempotency keys. Scheduled payroll starts are idempotent, runs can step back or be discarded, and updates use JSON Merge Patch (9 of 20). Creating a company needs four fields and an employee five. No public SDK (6 of 15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 48, "points": 8.4, "reason": "Bearer JWTs with one scope, `api`, lasting 24 hours. The sandbox uses the password grant with a client secret printed in the docs and shared by all sandbox users, and the browser flow uses `response_type` `id_token token`. Production credentials are issued by Worklio, and no rotation or revocation procedure was found (14 of 30). Four user levels are enforced per operation and an Employee sees only its own data. No read-only role was found. A run must be locked and finalised in separate calls (11 of 20). Responses carry text entered by employers and workers, with no injection guidance, and the employee create response echoes the full Social Security number (3 of 15). The security page says changes by administrators, employees and clients are logged in an audit trail. No general audit endpoint was found in the index (8 of 15). SOC 2 Type 2, ISO 27001, ISO 27018 and ISO 9001 are claimed, with outside penetration testing. No security.txt, disclosure policy or bug bounty (12 of 20)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 25, "points": 3.13, "reason": "Read with the hosted rubric. No x402, MPP or L402 (0). Retail list prices per person per month are public, $10 for Full-Service Payroll, and the page says they are not a quote and that the partner's rate card sits in its agreement (10 of 20). The sandbox is open to any registered developer per the docs. The registration page was not read because its host disallows crawlers, so the card question is open (15 of 20). A person registers in a browser (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 25, "points": 2.19, "reason": "The last dated API change is the pair of changelog entries of 30 June 2026, 101 days before the check (10 of 30). No changelog entry falls in the last 90 days. The docs sitemap shows 25 pages updated between 3 September and 8 October 2026, which we counted as half (10 of 20). A closed service with a help centre and a contact form, no public issue tracker or community (5 of 15). No public SDK or package (0 of 15, 0 of 10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 48, "points": 4.2, "note": "editorial 28, provenance 67", "reason": "Closed service. The only public terms are Terms of Use last updated 21 December 2014, written for a small-business HR site and limited to personal, non-commercial use. The partner agreement isn't public (8 of 30). The privacy policy is hosted on iubenda at a path its robots.txt disallows, so it was not read. The security page gives seven days of nightly backups, 35 days of point-in-time restore and storage in the United States. No DPA was found (8 of 30). The changelog notes replaced routes and a retired preview API, and the docs mark the v1 embedded screens as legacy with a migration guide. No removal dates or policy (5 of 20). Microsoft Azure and United States locations are named, and the docs mention Plaid and Middesk. No subprocessor list (7 of 20)." } ], "assessment": { "date": "2026-10-09", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "No field selection, and the pagination guide says most `/wep` endpoints return their full result set on every call (8 of 25). The `/api/public` endpoints take `limit`, `skip`, a filter language with 18 single-field operators and multi-field sorting, with a page token that expires after 60 seconds (12 of 20). Errors share one envelope with a code and per-field validation errors, but the Run Payroll guide tells callers to read an HTTP 500 with an untranslated message as the cue to finalise, and `errorCode` is null in that example (9 of 20). No idempotency keys. Scheduled payroll starts are idempotent, runs can step back or be discarded, and updates use JSON Merge Patch (9 of 20). Creating a company needs four fields and an employee five. No public SDK (6 of 15).", "maintenance": "The last dated API change is the pair of changelog entries of 30 June 2026, 101 days before the check (10 of 30). No changelog entry falls in the last 90 days. The docs sitemap shows 25 pages updated between 3 September and 8 October 2026, which we counted as half (10 of 20). A closed service with a help centre and a contact form, no public issue tracker or community (5 of 15). No public SDK or package (0 of 15, 0 of 10).", "payments": "Read with the hosted rubric. No x402, MPP or L402 (0). Retail list prices per person per month are public, $10 for Full-Service Payroll, and the page says they are not a quote and that the partner's rate card sits in its agreement (10 of 20). The sandbox is open to any registered developer per the docs. The registration page was not read because its host disallows crawlers, so the card question is open (15 of 20). A person registers in a browser (0).", "reliability": "Read with the hosted rubric, for embedded-payroll partner access. status.worklio.com exists and asks for a password, so there is no public status page (0) and no readable incident history (5). No rate limits were found in the docs index or the guides read (0). No 429 or backoff guidance and no idempotency keys. The reference says starting a scheduled payroll twice returns the same run, and that bonus, off-cycle, void and termination starts are not idempotent (5 of 15). The security page says the Service Level Agreement targets 99.9 per cent availability, with no SLA document or credits published (5 of 10). The API is in production use and not marked beta (10).", "schema": "Each of the 853 reference pages embeds an OpenAPI 3.0.4 fragment with schemas and the bearer scheme. No single downloadable spec was found (20 of 25). llms.txt and a Markdown copy of every page (10). 821 of 853 operations carry a description, and many state which user levels may call them and in which run state (14 of 20). Inputs are typed with formats and required flags. Enums are integers whose meanings sit in description text (10 of 15). The quick-start guides give curl, Node.js and Python examples with 400 responses, while the two reference pages sampled document only a 200 (7 of 15). An `api-version` header and a changelog with two entries, both dated 30 June 2026 (10 of 15).", "security": "Bearer JWTs with one scope, `api`, lasting 24 hours. The sandbox uses the password grant with a client secret printed in the docs and shared by all sandbox users, and the browser flow uses `response_type` `id_token token`. Production credentials are issued by Worklio, and no rotation or revocation procedure was found (14 of 30). Four user levels are enforced per operation and an Employee sees only its own data. No read-only role was found. A run must be locked and finalised in separate calls (11 of 20). Responses carry text entered by employers and workers, with no injection guidance, and the employee create response echoes the full Social Security number (3 of 15). The security page says changes by administrators, employees and clients are logged in an audit trail. No general audit endpoint was found in the index (8 of 15). SOC 2 Type 2, ISO 27001, ISO 27018 and ISO 9001 are claimed, with outside penetration testing. No security.txt, disclosure policy or bug bounty (12 of 20).", "transparency": "Closed service. The only public terms are Terms of Use last updated 21 December 2014, written for a small-business HR site and limited to personal, non-commercial use. The partner agreement isn't public (8 of 30). The privacy policy is hosted on iubenda at a path its robots.txt disallows, so it was not read. The security page gives seven days of nightly backups, 35 days of point-in-time restore and storage in the United States. No DPA was found (8 of 30). The changelog notes replaced routes and a retired preview API, and the docs mark the v1 embedded screens as legacy with a migration guide. No removal dates or policy (5 of 20). Microsoft Azure and United States locations are named, and the docs mention Plaid and Middesk. No subprocessor list (7 of 20)." }, "sources": [ { "what": "docs index with every guide and reference page", "url": "https://apidocs.worklio.com/llms.txt", "seen": "2026-10-09" }, { "what": "product overview", "url": "https://apidocs.worklio.com/docs/overview", "seen": "2026-10-09" }, { "what": "sandbox registration, token endpoint and grants", "url": "https://apidocs.worklio.com/docs/getting-an-api-access", "seen": "2026-10-09" }, { "what": "access modes", "url": "https://apidocs.worklio.com/docs/api-access-modes", "seen": "2026-10-09" }, { "what": "user levels", "url": "https://apidocs.worklio.com/docs/user-types", "seen": "2026-10-09" }, { "what": "payroll run sequence and the 500 response", "url": "https://apidocs.worklio.com/docs/run-payroll-1", "seen": "2026-10-09" }, { "what": "pagination, filtering and sorting", "url": "https://apidocs.worklio.com/docs/pagination", "seen": "2026-10-09" }, { "what": "webhook registration and signing", "url": "https://apidocs.worklio.com/docs/registering-a-webhook", "seen": "2026-10-09" }, { "what": "webhook event types", "url": "https://apidocs.worklio.com/docs/webhook-events", "seen": "2026-10-09" }, { "what": "company and employee creation guides", "url": "https://apidocs.worklio.com/docs/create-an-employee", "seen": "2026-10-09" }, { "what": "front-end library and private repository", "url": "https://apidocs.worklio.com/docs/front-end-library-1", "seen": "2026-10-09" }, { "what": "reference page with OpenAPI fragment", "url": "https://apidocs.worklio.com/reference/post_wep-companies-companyid-payroll", "seen": "2026-10-09" }, { "what": "changelog, v1", "url": "https://apidocs.worklio.com/changelog/v1-api-updates", "seen": "2026-10-09" }, { "what": "changelog, v2", "url": "https://apidocs.worklio.com/changelog/worklio-api-changelog", "seen": "2026-10-09" }, { "what": "docs sitemap with page update dates", "url": "https://apidocs.worklio.com/sitemap.xml", "seen": "2026-10-09" }, { "what": "security page", "url": "https://www.worklio.com/security", "seen": "2026-10-09" }, { "what": "retail list prices", "url": "https://www.worklio.com/partners/revenue-stack", "seen": "2026-10-09" }, { "what": "embedded payroll page", "url": "https://www.worklio.com/embedded-payroll", "seen": "2026-10-09" }, { "what": "Terms of Use", "url": "https://www.worklio.com/terms", "seen": "2026-10-09" }, { "what": "privacy page", "url": "https://www.worklio.com/privacy", "seen": "2026-10-09" }, { "what": "about page", "url": "https://www.worklio.com/about", "seen": "2026-10-09" }, { "what": "status page, password protected", "url": "https://status.worklio.com", "seen": "2026-10-09" }, { "what": "domain registration", "url": "https://rdap.verisign.com/com/v1/domain/worklio.com", "seen": "2026-10-09" } ], "openQuestions": [ "unchecked: the privacy policy. It is hosted at www.iubenda.com/privacy-policy/25719508, a path iubenda's robots.txt disallows", "unchecked: the developer registration page and sandbox dashboard at apiweb.worklio.com, whose robots.txt disallows every path. Whether registration needs a card or approval is not known", "unchecked: the help centre at support.worklio.com, which was not read", "Whether a single OpenAPI file can be downloaded. Only per-page fragments were seen", "Whether the old time-off request routes stopped answering on 30 June 2026 and whether partners had earlier notice", "Rate limits and whether 429 responses carry Retry-After. Nothing was found, and we had no token", "Partner prices, the partner agreement, the SLA text and any DPA or subprocessor list", "How production client credentials are issued, rotated and revoked", "The scope and dates of the SOC 2 and ISO certificates named on the security page", "The legal entity's address and state of incorporation. The footer says Worklio, Inc. and the about page says Worklio LLC was established in 2017" ] }, "negative": -3, "negativeNotes": [ "30 June 2026. The changelog entry that announces the reworked Time-Off Requests API says the older `timeoffrequests` routes were replaced by hyphenated routes and tells integrators to update, in the same note and with no earlier notice found. Whether partners were told privately is unknown, so the smallest deduction applies (-3). https://apidocs.worklio.com/changelog/v1-api-updates" ], "verdict": "Worklio documents 853 REST operations with an OpenAPI fragment on every reference page, and a developer can register for the sandbox without a sales call. No rate limits or public SDK were found, the status page is password protected, and the payroll guide tells callers to treat an HTTP 500 as the signal to finalise.", "bestFor": "A software platform, PEO or payroll bureau that wants to sell US payroll under its own brand and can sign a partner agreement, with Worklio handling tax filing and money movement.", "strengths": [ "853 documented operations across 17 API groups, each reference page carrying an OpenAPI 3.0.4 fragment, plus llms.txt and a Markdown copy of every docs page", "Sandbox access is self-serve. A developer registers, uses a shared sandbox client secret printed in the docs and gets a bearer token", "A payroll run moves through steps with next, previous, discard, lock and finalise calls, and starting a scheduled run twice returns the same run", "Every operation states which user levels may call it (System, Admin, ClientAdmin, Employee, or anonymous with a link token)", "The security page claims SOC 2 Type 2, ISO 27001, ISO 27018 and ISO 9001, with third-party penetration testing" ], "weaknesses": [ "No rate limits, 429 handling or idempotency keys were found in the reviewed documentation", "status.worklio.com asks for a password, so no public incident history exists", "The Run Payroll guide says the `next` call answers HTTP 500 with an untranslated message when a run is ready to finalise", "No public SDK. `@worklio/sdk` and the component library sit in a private repository granted through support", "The public Terms of Use are dated 21 December 2014 and describe a small-business HR site. The partner agreement and production prices aren't public" ], "agentNotes": [ "Send `api-version: 2.0` on `/wep` calls. The reference marks the header as required", "Get a token from `POST https://api.worklio.com/connect/token` with the password grant and scope `api`. It lasts 24 hours, so fetch a new one daily", "Run payroll as start, `next` until it answers 500 with \"Next step operation is not allowed\", then `finalize`. Don't treat that 500 as a failure", "Don't retry bonus, off-cycle, void or termination payroll starts blindly. The reference says those calls are not idempotent", "Most `/wep` list endpoints return the whole result set. Paging, `filter` and `sort` work only under `/api/public`, and a `DataToken` expires after 60 seconds" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "E", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 38.6 } ], "editorialScores": { "ergonomics": 44, "maintenance": 25, "payments": 25, "reliability": 25, "schema": 71, "security": 48, "transparency": 28 }, "provenanceScore": 67 }, "connect": { "http": "curl -s -X POST \"https://api.worklio.com/connect/token\" \\\n -H \"accept: application/json\" \\\n -H \"content-type: application/x-www-form-urlencoded\" \\\n --data-urlencode \"grant_type=password\" \\\n --data-urlencode \"username=$WORKLIO_USERNAME\" \\\n --data-urlencode \"password=$WORKLIO_PASSWORD\" \\\n --data-urlencode \"scope=api\" \\\n --data-urlencode \"client_id=wep_resourceowner.public.api\" \\\n --data-urlencode \"client_secret=$WORKLIO_CLIENT_SECRET\"" }, "letme": { "capability": "https://letme.dev/payroll.run", "tool": "https://letme.dev/worklio" }, "notable": [ "The docs index lists 853 operations (422 GET, 255 POST, 71 PUT, 59 DELETE, 46 PATCH) in 17 groups, and each reference page embeds an OpenAPI 3.0.4 fragment (https://apidocs.worklio.com/llms.txt)", "Sandbox access starts with developer registration at apiweb.worklio.com, and the docs print a shared sandbox client secret for the password grant. Tokens last 24 hours (https://apidocs.worklio.com/docs/getting-an-api-access)", "The Run Payroll guide documents an HTTP 500 with the message a missing translation key as the normal signal that a run has no more steps and should be finalised (https://apidocs.worklio.com/docs/run-payroll-1)", "Paging, filtering and sorting apply to the v1.0 `/api/public` endpoints. The guide says most `/wep` endpoints return their full result set on every call (https://apidocs.worklio.com/docs/pagination)", "Webhooks are signed with HMAC-SHA256 in a `WEP-Sign` header. All webhooks of one company share a key, and resetting it means deleting every registration (https://apidocs.worklio.com/docs/registering-a-webhook)", "The changelog has two entries, both dated 30 June 2026. One says the older time-off request routes were replaced by hyphenated routes (https://apidocs.worklio.com/changelog/v1-api-updates)", "A partner page publishes retail list prices per person per month, with Full-Service Payroll at $10, and says the partner's own rate card sits in its agreement (https://www.worklio.com/partners/revenue-stack)", "status.worklio.com answers with \"This status page is password protected\" (https://status.worklio.com)" ], "area": "domain-data", "details": [ { "label": "Access graded", "value": "Embedded-payroll partner access through the REST API. A platform, PEO or payroll bureau runs payroll for its own client companies. No connector into an employer's payroll account at another provider" }, { "label": "API", "value": "REST at https://api.worklio.com, `/wep/...` paths with an `api-version` header (2.0 in the reference) and `/api/public/...` paths for v1.0 list endpoints. 853 operations in 17 groups, among them Company, Employee, Payroll, Reports, Benefits Deductions, Time Attendance, W4 Requests and Client General Ledger" }, { "label": "Payroll run", "value": "`POST /wep/companies/{companyId}/payroll` starts the default run, `.../payroll/{runId}/next` advances it, `.../finalize` finalises a locked run. Previous-step and discard calls roll a run back, and a locked run can't be discarded after its deadline" }, { "label": "Credentials", "value": "OAuth 2.0 bearer JWT from `POST /connect/token`. Password grant for a System user (scope `api`, 24 hours), or an OpenID Connect browser flow for Admin and Employee users through the unpublished `@worklio/sdk`" }, { "label": "User levels", "value": "System (all companies it created, suited to machine-to-machine use), Admin and ClientAdmin (one company), Employee (own data only)" }, { "label": "Rate limits", "value": "None found in the reviewed documentation" }, { "label": "Paging and filters", "value": "`limit`, `skip`, `filter` and `sort` as query parameters or `x-api-*` headers on `/api/public` endpoints, with a `DataToken` that expires after 60 seconds. Most `/wep` endpoints return everything" }, { "label": "Errors", "value": "One JSON envelope with `status`, `code`, `errorCode`, `message` and per-field `validationErrors`. The reference pages sampled document only the 200 response" }, { "label": "Webhooks", "value": "Company-level or system-wide, filtered by category (all, payroll, employee, client). HMAC-SHA256 signature in `WEP-Sign`. Payroll events are `Started`, `OnTimeSheet`, `Calculated`, `Approved`, `Locked` and `Finalized`" }, { "label": "SDKs", "value": "None public. `@worklio/sdk`, `@worklio/wep`, `@worklio/wep-vue` and `@worklio/wep-react` are not on npm, and the docs send developers to support for access to a private GitHub repository" }, { "label": "Sandbox", "value": "Self-serve developer registration at apiweb.worklio.com/RegisterDeveloper, then a dashboard of test companies. Production credentials and single sign-on are set up by Worklio" }, { "label": "Certifications", "value": "SOC 2 Type 2, ISO/IEC 27001:2013, ISO/IEC 27018:2019 and ISO 9001:2015 claimed on the security page. Hosted on Microsoft Azure in the United States" } ], "provenance": { "legalEntity": "Worklio, Inc.", "domain": "worklio.com", "domainRegistered": "2015-03-10", "endpointOnVendorDomain": true, "terms": "", "privacy": "https://www.worklio.com/privacy", "statusPage": "", "changelog": "https://apidocs.worklio.com/changelog", "securityTxt": "none", "checked": "2026-10-09", "notes": [ "The site footer reads \"© 2026 Worklio, Inc.\". The about page says Worklio LLC was established in 2017. No postal address was found on the pages read.", "No terms link is given. The only public terms are the Terms of Use at www.worklio.com/terms, last updated 21 December 2014, which describe an HR site for small businesses and predate the embedded API. The partner agreement that governs API use isn't public.", "www.worklio.com/privacy embeds a policy hosted at www.iubenda.com/privacy-policy/25719508. iubenda's robots.txt disallows that path, so the policy text was not read.", "status.worklio.com exists (an UptimeRobot page) and answers \"This status page is password protected\", so it is not recorded as a public status page.", "www.worklio.com/.well-known/security.txt returns 404.", "The changelog holds two entries, both dated 30 June 2026.", "RDAP for worklio.com gives a registration date of 2015-03-10." ], "score": 67, "checks": [ { "check": "Legal entity named", "value": "Worklio, Inc.", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "worklio.com, registered 2015-03-10 (11 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "api.worklio.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Privacy policy", "value": "published, but our reader couldn't read it", "points": 7, "max": 10, "state": "part" }, { "check": "Status page", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" } ], "policies": [ { "kind": "terms", "url": "", "state": "none-found", "points": 0, "max": 10 }, { "kind": "privacy", "url": "https://www.worklio.com/privacy", "state": "unreadable", "reason": "the page has only its navigation and a footer without a browser, so the policy is drawn by script or sits elsewhere", "readAt": "2026-10-08", "points": 7, "max": 10 } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/worklio.json", "live": { "slug": "worklio", "probe": { "target": "https://api.worklio.com", "method": "get", "lastAt": "2026-10-09T10:14:32.874135866Z", "lastOk": true, "lastStatus": 404, "lastMs": 457, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 468, "p95ms24h": 504, "samples24h": 28, "samples30d": 28, "days": [ { "date": "2026-10-09", "probes": 28, "ok": 28 } ] }, "updatedAt": "2026-10-09T10:14:32.874135866Z" } } }