Security and trust
For security, compliance, and procurement teams
We sit in the path ofyour agents. Here is howwe earn that.
Waxell is SOC 2 Type II attested and ISO/IEC 27001:2022 certified, supports HIPAA with a Business Associate Agreement, and is aligned to the EU AI Act and NIST AI RMF. The reports are in the Trust Center, and the controls are described below.
Tenant isolation
Every workspace is its own Postgres schema behind tenant middleware; nothing is shared at the row level.
Encryption
TLS 1.2 or higher in transit everywhere. Encryption at rest for databases, caches, and object storage. Customer-managed keys for enterprise tenants on request.
Identity and access
SAML and OIDC single sign-on, SCIM provisioning, directory sync, enforced MFA, role-based access, scoped API keys, and offboarding that revokes an agent's grants with the person's.
Audit and retention
Every decision is written to a durable, exportable record with the policy that made it. Audit logs export daily in WORM-protected form. Retention is configurable per data class up to seven years, with legal hold.
Availability
Multi-AZ databases, independent health checks on every public endpoint, and a public status page. Availability evidence is kept for fifteen months for auditors.
Secure development
Dependency and container vulnerability scanning on every image, patched images rebuilt and redeployed on a cadence, code review and merge requests for every production change.
Subprocessors
A published list, with notice before any change. Model providers you bring your own keys for are your processors, not ours.
Incident response
A tested incident-response plan with customer notification commitments in the DPA, and shorter windows for regulated tenants.
- Master Subscription Agreement
- Data Processing Addendum
- Subprocessors
- Acceptable Use Policy
- Privacy Policy
- Support plans
- Business Associate Agreement and the Regulated Services Addendum, on request for HIPAA tenants.
Found a vulnerability? Write to security@waxell.ai. We acknowledge within one business day, keep you informed while we fix it, and credit researchers who want to be credited.
Live service health is on the status page. Security questionnaires, pen-test summaries, and the SOC 2 report are in the Trust Center.
The same controls we are audited on are the ones the product gives you.
Every agent decision carries the policy that made it. That record is what your auditor asks for, and it is a side effect of running.