Security

UK data residency — and where it stops

Everything at rest lives in Google Cloud’s London region (europe-west2): the database, your uploaded documents, extracted text, embeddings and backups.

Four processing steps leave that region, and we would rather name them than let “UK-hosted” imply more than it should. Drafting prompts — which include passages from your documents — route via OpenRouter in the US. Uploaded files may be parsed by Reducto in the US. Google’s ranking service, which re-orders retrieved passages before drafting, is a global endpoint. And the web front end — the server that builds every page you see from our API’s answers, and carries what you type, upload and download to and from that API — runs in Google Cloud’s Belgium region (europe-west1), inside the EEA. All four are in the table below.

The front end keeps nothing on disk — a Cloud Run server has none. To keep pages quick it holds working copies of some workspace details in the server’s memory: your company profile and settings, your library list, and the titles of your tenders and questions. They are refreshed as you work and discarded when the server is replaced, which happens routinely. Your documents, drafts and answers are never kept there. Programs that use an API key talk to the API in London directly and never pass through it.

Your data is never used to train models

We do not train models on your data, and there is no model-training or fine-tuning code in WayWiser at all. Drafting works by retrieving from your library at request time — not by baking your bids into a model.

Every request we send to OpenRouter carries a routing restriction limiting it to providers that do not retain or train on inputs, and that restriction is covered by a test so it cannot be dropped quietly. To be precise about its limit: it is a routing control operated by OpenRouter, not a signed no-training contract with each downstream model provider, and we do not hold one of those today.

Tenant isolation

Every tenant-scoped table carries a company identifier enforced twice: PostgreSQL row-level security (forced, no bypass for the application role) and explicit company scoping in every query. Within a company, corpus-level access control lists restrict which users can read which document collections. Content you upload is never added to the shared reference library that other customers can search.

What our staff can see

Named WayWiser administrators can access customer workspaces. This is how we support accounts, investigate faults and manage the shared reference library, and we would rather state it plainly than let “isolation” imply that nobody at WayWiser can ever look. The access is limited to those named administrators, not to everyone who works here.

Privileged administrative actions are written to the audit log described below. Each time a WayWiser administrator opens a customer workspace they are not a member of, an entry is written to that workspace’s audit log and shown to its admins under Company settings → WayWiser staff access (one entry per person per hour). Individual page reads inside the workspace are not itemised.

Authentication

Sign-in is handled by WorkOS AuthKit with verified email/password. Enterprise SAML/OIDC single sign-on and directory sync are available on request through the same provider. We never see or store passwords.

Encryption

TLS 1.2+ for all traffic in transit. Encryption at rest is enabled across the database, object storage and backups (AES-256, managed by Google Cloud).

Deletion

A workspace administrator can delete the workspace. That starts a seven-day window you can cancel at any time; after it passes, a nightly job erases the workspace’s database records, its uploaded documents and tender packs, any data-export archive previously generated for it, and the accounts of people who belonged to no other workspace. A single audit entry recording that the deletion happened is kept, with no personal data in it.

Two kinds of copy outlive that, and we publish the windows rather than implying erasure is instant: encrypted database backups and point-in-time-recovery logs (7 days), and prior versions of stored files (30 days). Both then expire automatically.

Auditability

Privileged actions — membership changes, corpus grants, model and prompt changes, exports and deletions — are written to an append-only audit log with actor, action and timestamp. The trail deliberately outlives the workspace it refers to, with its references to that workspace removed.

Certifications we do not hold

We hold no security certifications today — not ISO 27001, not SOC 2, not Cyber Essentials. We are building our information security management system towards ISO 27001. This page will link the certificate when it is achieved, and not before.

Subprocessors

Everyone who processes data on our behalf, what they receive and where. Our privacy policy explains the legal basis for each.

Vulnerability disclosure

Found something? Email security@waywiser.ai. We acknowledge reports within 2 business days and will not pursue good-faith research.