Security at Wand

SaaS platform. Report available to customers under NDA once the examination concludes.

EU/EEA customer personal data processing.

Infrastructure & Cloud Security

6 controls

• ✓Private architecture — production compute runs in a private configuration with no direct public administrative access from the internet
• ✓Network segmentation — segmented network topology with least-privilege traffic rules enforced between layers; firewall rules are reviewed at least annually
• ✓Encryption at rest — strong industry-standard encryption is applied to stored data across our storage and database services
• ✓Encryption in transit — modern TLS is enforced on external endpoints
• ✓Vulnerability scanning — continuous vulnerability scanning and alerting across our cloud workloads
• ✓DDoS protection — network and edge-level protections against denial-of-service attacks

Access Control

6 controls

• ✓Identity — single sign-on with multi-factor authentication for personnel
• ✓Least privilege — role-based access control applied across systems, with access granted on a least-privilege basis
• ✓Privileged access — administrative access to production is restricted to controlled, audited pathways
• ✓Secrets management — credentials are managed through dedicated secrets management; we do not permit plaintext secrets in source code repositories
• ✓Access reviews — we conduct periodic access reviews, at least quarterly, across in-scope systems
• ✓Offboarding — our policy is to revoke access upon role change or termination

Application Security

4 controls

• ✓Secure development — security considerations are integrated into our development lifecycle, and our policy requires peer code review for changes
• ✓CI/CD pipeline — changes flow through an automated build and deployment pipeline
• ✓Container security — container images are scanned before deployment, with admission controls applied
• ✓Dependency management — automated dependency and vulnerability scanning

Monitoring & Incident Response

4 controls

• ✓Logging & monitoring — centralized logging and monitoring with alerting
• ✓Threat detection — security monitoring with anomaly detection
• ✓Incident response — we maintain a documented incident response plan
• ✓Security incidents — in the event of a security incident affecting personal data, we will notify affected parties and the appropriate authorities as required by applicable law

People Security

1 control

• ✓Security awareness training — personnel complete security awareness training

Business Continuity & Disaster Recovery

3 controls

• ✓Resilient deployment — production is deployed across multiple availability zones
• ✓Backups — regular backups of critical systems and data, with defined retention
• ✓Disaster recovery — a secondary region is configured to support recovery

Vendor & Third-Party Risk

3 controls

• ✓Sub-processor review — cloud and SaaS sub-processors are reviewed at least annually
• ✓Data Processing Addenda — we put data processing terms in place with sub-processors that handle personal data
• ✓Cybersecurity insurance — Wand maintains a cybersecurity insurance policy
• ✓Vendor access — third-party access to personal data is limited to what is necessary

Data classification

Data is classified with corresponding handling requirements.

Data minimization

We aim to limit the personal data we store to what is necessary.

Data retention

Personal data is retained only as long as necessary for the purposes described in our Privacy Policy.

Data deletion

We honor data subject and deletion requests as required by applicable law; submit requests to privacy-dpo@wand.ai.

International transfers

Where personal data is transferred across borders, we use appropriate safeguards.

Sub-processors

We maintain a sub-processor inventory, available on request.