Appen Verifies a Global Contractor Workforce for a Fortune 50 Client In Under a Month with Twingate

Appen exists to get data in front of AI models. The company sources and annotates the speech, image, and text data companies need to train and evaluate their models, and does it through CrowdGen, a marketplace of more than a million contributors around the world working in hundreds of languages. 

If a company needs a French-speaking linguist, a physician to validate medical responses, or a few thousand people to label images by Friday, Appen finds them.

"Appen is to data for AI what Uber is to people wanting a ride," said Bobby Smith, VP of Engineering and Platform. 

On one side, companies come to Appen needing data collected, labeled, or validated. On the other, CrowdGen's contributors, Appen's independent contractor workforce, pick up the work.

That marketplace model is what a Fortune 50 technology client leaned on when it needed a large-scale project staffed fast, and it's what turned into Appen's first real test of Twingate.

A one-month deadline, no room for a mediocre answer

The client, which Appen isn't able to name, came with two hard requirements: verify that every contributor logging into the project was who they claimed to be, and keep the client's application off the public internet entirely, reachable only from approved IP addresses. 

Appen had a month to deliver both, for a project that would eventually involve 5,000 to 6,000 contributors and about 15 internal Appen employees.

Before shifting to remote work, Appen brought contributors into secured, on-site facilities, where verifying who someone was and what they could touch was handled by the building itself, not by any system Appen had to build or maintain. Moving that same work out to a distributed, global workforce meant those guarantees no longer came for free.

"You need to know someone is who they say they are, and you need a record every time they log in to a client system," said Smith. 

This isn’t a challenge unique to Appen. It's what happened to countless organizations operating at massive scale globally. As work moves off-site, verification has to move with it.

Building the verification and app-gating layer in-house was never seriously on the table. "We didn't want to invest what it would take to build this ourselves and end up with something subpar,” Smith said. “It came down to a straightforward build-versus-buy decision, and you go with the leader in the space when your client is the best of the best." 

Appen selected Twingate to meet the deadline, deploying it first around the client project before expanding its use elsewhere. 

While they were immediately impressed with the intuitive UI of the Twingate Admin Console, the real test would be whether or not Twingate could meet the tight deployment timeline and unique technical constraints presented by the Appen CrowdGen contributor workforce.

Testing had to work within the same constraints as the deployment itself. Rolling Twingate out wasn't yet a mandatory part of onboarding, so Appen could only recruit contributor volunteers to test it, offering compensation for their time and feedback. To confirm that testing (and the feedback attached to it) was real, Appen checked it against usage data in the Twingate Admin Console rather than taking self-reports at face value. 

That same rigor extended to the client relationship: because the deployment had to satisfy the client's own security review before go-live, every step of it was documented in enough detail to hold up to outside scrutiny, not just to get contributors working.

Built for hardware and internet Appen doesn't control

CrowdGen's scale creates a compatibility problem most enterprise IT teams never face. 

Appen doesn't manage devices for its contributors. Instead, people connect from their own laptops, on their own internet connections, from every part of the world, and Appen has no visibility into what hardware or bandwidth is on the other end until someone logs in.

"We don't do device management for contributors, so we need real OS parity and compatibility across a huge range of specs," Smith said. 

Older machines, inconsistent connections, and locked-down home networks are the norm, not the exception. A VPN that slows down a connection or fails on an unsupported OS doesn't just create a support ticket. It takes a contributor offline entirely.

With no MDM for contractors and no way to manage contributor hardware directly, Appen couldn't push Twingate onto devices the way it would for an employee laptop. Instead, the team built a page on CrowdGen's own platform for contributors staffed on the project, offering a custom installer that handled the download, installed the Twingate client with minimal manual setup, and pre-filled the client's tenant URL so contributors weren't left guessing which network to join. 

Across that entire range of devices and connections, on a project the client was watching from day one, OS parity and performance weren't abstract product claims. They were the difference between a contributor hitting a deadline and missing a paycheck. 

Twingate was put to the test, and delivered. The Appen team was able to deploy quickly, test across a wide range of devices and connectivity levels, all while meeting their client’s stringent security requirements. 

In addition to completing testing and deployment within the Appen client’s timeline, Twingate shipped a Keycloak SSO integration requested by the Appen team within that same period.

Benefits that spread beyond the original project

Verifying contributor identity ended up doing more than satisfy the client's compliance requirement. It cut against a common assumption about security: that more verification always means more friction for the end user. 

For contributors, the opposite played out. Before Twingate, the absence of a reliable way to confirm who was accessing a project was itself a source of friction, typically in the form of inconsistent access and payment issues. 

"We want to make sure we can pay contributors correctly, protect them, and create the least amount of friction possible for them to come in and do the work they need to do," Smith said. Verifying identity closed that gap instead of opening a new one.

That gap-closing effect didn't stay confined to the original client project, either. The same platform that held up across thousands of unmanaged devices and unreliable home connections now secures a much smaller, far more controlled environment: Appen's own internal dev, test, and stage systems. 

Delivery teams use Twingate to secure applications built for AI labs and frontier model developers, work Smith describes as expanding well beyond traditional engineering as AI-assisted development spreads through the company. Twingate enables the team to build quickly while keeping those internal tools off the public internet. Even HR and marketing teams building their own internal apps rely on Twingate to keep them restricted to the company.

"It's a mini version of the same use case we have with our largest client," Smith said. "Different scale, same problem: keep it secure, keep it internal."

Managing that footprint, now stretched across a Fortune 50 contractor base and Appen's own global engineering org, hasn't required a large team. Appen's Twingate administration sits with an IT lead based in the Philippines, working alongside a colleague in India, supported by lightweight automation, like the account-cleanup tooling the team built itself.

A two-person operation is able to manage Twingate while keeping pace with CrowdGen's turnover without extra headcount. That's a setup that has historically made documentation and handoffs harder for other tools Appen runs globally. Twingate wasn't one of them.

"Twingate operates at the same global scale we do, both as a technology and as an organization," Smith said. "Our new admin didn't need deep training. He was handed it and could just run with it. That's not something we can say about every vendor we work with across time zones."

Two smaller benefits emerged along the way, neither one anything Appen went explicitly looking for. 

The first is a matter of scale, not character: a contributor base the size of CrowdGen's will occasionally include someone testing the edges of the rules, the same way any large marketplace does. For Appen, this typically looked like a contributor sharing a login, creating a second account to get around a task limit, or using a VPN to appear eligible for a different market. 

The usage and network data already sitting in the Twingate Admin Console gave Appen's project managers one more signal to fold into the quality checks they already run, flagging things like one account connecting from several locations at once, multiple accounts sharing an IP, or login volume no single person could generate by hand. 

The second benefit is more straightforward: because Twingate split-tunnels by default, only traffic bound for Appen's network actually touches Appen's network. Whatever a contributor does with the rest of their connection stays off it. For legal and general counsel operating at Appen's global scale, that's a quiet but welcome reduction in exposure.

Looking forward

Appen still has Twingate capabilities it hasn't tapped yet, and Smith sees the next phase of the partnership extending further into the company's fastest-growing work: building and securing applications for frontier AI model developers, a client category that is growing rapidly.

"There's more we can do together," Smith said. "A lot of our delivery teams are building applications that need to be available to people outside Appen without ever being public. That's a direction we want to explore."

For Smith, that future use case is really an extension of what has already worked. Twingate handled the highest-stakes version of Appen's access problem: a Fortune 50 client, a one-month deadline, and thousands of contributors on unmanaged devices worldwide. Then it scaled down just as cleanly to secure a handful of internal tools running the same model. Appen has now tested Twingate's OS parity, performance, and reliability at both extremes of scale, and watched them hold at each end. Whatever the company builds next, that's the bar it's already cleared.