Support for SAML 2.0 and OpenID Connect lets customers apply their own identity policies while providing users with seamless access.

Access rights are provisioned strictly to the minimum level necessary for each role, cutting down lateral movement and data exposure.

Customers can enforce their own identity policies through SAML 2.0 and OpenID Connect, allowing corporate MFA, conditional access, and streamlined user lifecycle management.

User roles are provisioned so each person only receives the minimum access needed for their job, limiting the blast radius of any compromised credential.

Leadership reviews and validates every privileged account every quarter to ensure permissions remain appropriate as roles change.

User accounts are automatically created, updated, and removed based on identity-provider changes, preventing orphaned access and ensuring timely deprovisioning.

Granular admin, expert, and user roles map directly to business needs so permissions align with least-privilege principles.

SCIM 2.0 and just-in-time provisioning automatically create, update or revoke accounts when staff join, move or leave, eliminating orphaned access.

New users receive documented approval before accounts are created and departing users have all access disabled within one business day, eliminating orphaned credentials.

Production environments may only be reached through approved encrypted channels, safeguarding credentials and session data in transit.

Documented reviews of all production accounts verify that privileges remain appropriate and any unnecessary access is removed.

Personnel with elevated privileges use separate admin credentials, keeping routine activities isolated from powerful functions.

Accounts for departing personnel are disabled within one business day, closing common insider threat windows.

Only authorized personnel can reach production resources and must do so through approved, encrypted channels to shield credentials and traffic from interception.

All privileged and customer-facing systems require a second factor to verify user identity, dramatically reducing the likelihood of account takeover attacks.

Customer data, temporary files and backups are protected with strong AES-256 encryption whenever stored on disk.

Secure transport protocols are mandated for all external and internal transfers, preventing eavesdropping over public networks.

Customer data is purged within 90 days of contract termination, with optional zero-retention modes for stricter needs.

Company-issued laptops are required to use whole-disk encryption, preventing data loss if a device is lost or stolen.

Information is tagged as secret, confidential, internal or public to dictate handling, retention and disposal requirements in line with legal obligations.

Information is labeled public, internal, customer or company data to ensure each class receives the right protection level.

Information is labeled as secret, confidential, internal, or public, enabling appropriate handling, retention, and disposal according to sensitivity.

Data is retained only for the customer-defined period and purged within 90 days of contract end or sooner on request, meeting regulatory and contractual mandates.

Employee laptops are required to use full-disk encryption, reducing data-exposure risk if a device is lost or stolen.

Electronic media containing confidential information is purged or destroyed and certificates of destruction are retained.

Processes allow customers to have their data securely erased or expired data removed in line with contractual and regulatory obligations.

All employee laptops are centrally enforced to use disk-level encryption, locking out attackers even if hardware is lost or stolen.

Daily backups are run automatically and replicated across availability zones, providing encrypted copies for disaster recovery.

Customer documents and queries are never fed into shared AI models, eliminating unauthorized reuse and safeguarding proprietary information.

Documented standards embed security requirements throughout design, coding, testing, and deployment activities.

Independent security experts test the production environment each year, and all high or critical findings must be remediated before closure (current retest shows zero).

Documented policies integrate security requirements and reviews into every phase of software design, build, test and release.

Automated scanning of source and running applications detects weaknesses early in the build pipeline.

GitHub Dependabot scans every build for known CVEs, automatically opening pull requests so patches are applied before vulnerabilities can be exploited.

Experienced engineers must approve every code change, ensuring adherence to secure coding practices before release.

GitHub Dependabot continuously flags vulnerable libraries so engineering can patch or replace them quickly.

Independent testers conduct at least annual assessments, with the latest report showing zero critical findings after remediation.

Independent testers probe the production environment each year, and high-severity findings are tracked to verified closure.

A managed WAF blocks common web threats and combined DDoS protection keeps the service available even during volumetric attacks.

Every change requires approval by qualified reviewers to catch defects and enforce secure coding standards before deployment.

Discovered hard-coded or exposed secrets follow strict timelines—critical items fixed within 10 days—to eliminate attack windows.

All application containers are built from approved sources and stored in a private registry to block malicious code insertion.

Only trusted, privately stored container images can be deployed, reducing the chance of introducing malicious or unverified code to production.

Production images are pulled only from a private registry populated with vetted sources, preventing unverified code from entering the platform.

Branch protections and enforced reviews mean only qualified engineers can promote code, preventing unauthorized or risky changes from reaching customers.

AWS GuardDuty continuously analyzes logs for malicious activity and alerts security responders.

Production workloads run across separate availability zones, eliminating single points of failure and improving uptime.

Workloads run across multiple availability zones, removing any single point of failure and improving service uptime commitments.

Services run across multiple cloud availability zones so a single-site failure does not impact customer uptime.

Perimeter filtering blocks common exploits and DDoS traffic before it can impact application availability or data.

Layered firewall rules and segmented VPCs restrict east-west traffic and block unauthorized external connections.

Traffic is automatically distributed across instances and zones, adding capacity and mitigating localized spikes or failures.

Production resources reside in isolated subnets so internal services are not directly exposed to the internet.

Systems are continuously monitored for drift from approved configurations and automatically remediated or alerted.

Encrypted backups run daily and replicate to separate zones so data can be rapidly restored even in a regional outage.

Network firewalls block all traffic unless explicitly allowed, reducing exposure to unsolicited connections.

Running the platform across multiple availability zones increases resilience against data-center failures.

The platform automatically provisions resources and distributes traffic as usage grows, maintaining performance without manual intervention.

Continuous monitoring services watch for anomalous activity in accounts and generate real-time alerts for security personnel.

Cloud-native web application firewall and DDoS services filter malicious traffic before it reaches application resources.

Ingress and egress rules tightly control network traffic to only required ports and protocols.

Ingress and egress rules block all traffic unless explicitly permitted, reducing the platform’s attack surface.

Real-time metrics trigger automated provisioning of additional resources to maintain performance under load.

Clear playbooks define roles, escalation paths and customer notification procedures for security events.

Comprehensive playbooks define roles, escalation paths, and evidence preservation steps so teams can act decisively under pressure.

Clear roles, escalation paths and communication protocols are in place so the team can act decisively during a security event.

Table-top and drill exercises test the plan each year, driving improvements from real-world lessons.

Monitoring tools send immediate notifications to dedicated channels, ensuring swift human review of potential incidents.

Security tools stream alerts to dedicated channels monitored by the response team, reducing mean-time-to-detect and respond.

Monitoring tools push security alerts to dedicated channels, enabling immediate triage by on-call personnel.

All incidents are logged and tracked to closure, providing auditable evidence of timely remediation.

All incident workflows include collecting and safeguarding logs and artifacts to support forensic analysis and reporting.

Table-top and technical exercises validate that procedures work as intended and highlight areas for continuous improvement.

Post-incident reviews identify systemic issues and feed improvements back into the security program.

After any incident, the team conducts root-cause analysis and documents lessons learned to prevent recurrence.

Trained personnel are on call to triage, contain, and communicate security incidents, ensuring rapid, coordinated action.

Tasks arising from an incident are prioritized, assigned and monitored to completion to verify issues are fully resolved.

An external auditor validated the design and operating effectiveness of controls over security, availability, and confidentiality for a three-month period.

A licensed CPA firm verified that controls for security, availability, and confidentiality were designed and operated effectively throughout the audit period.

An external audit confirmed the design and operating effectiveness of controls for security, availability and confidentiality over a full period.

Management reviews each security control yearly to verify effectiveness and document remediation actions.

A formal report from a certified security firm confirms that all previously identified findings were remediated and no new vulnerabilities remain.

Independent CPAs examined the system using AICPA standards and issued an unqualified opinion on control effectiveness.

A centralized tool continuously gathers evidence and monitors control status, streamlining audits and reducing manual effort.

Senior management formally re-evaluates and signs off on the information security program every year to keep it current.

Automated checks alert owners when a control drifts out of compliance, enabling prompt corrective action.

The organization formally documents and rates risks each year, using results to prioritize new or improved controls.

Ethical hackers are incentivized to disclose vulnerabilities responsibly, providing an extra layer of continuous security testing.

A $1 million liability policy provides financial backing and assurance to customers in the unlikely event of a breach.

Information security policies are formally reviewed and approved at least once per year.

Senior leadership reviews security objectives and metrics every quarter, ensuring governance and accountability remain aligned with business goals.

Logs from applications and infrastructure flow to an immutable store where they are retained per policy for audits.

System, application, and access logs flow into a unified platform that supports searching, correlation, and retention.

System and application logs are collected in one place where automated rules detect suspicious patterns.

Automated tools analyze logs and metrics for anomalies, sending high-fidelity alerts to security staff.

Machine-learning analysis continuously looks for unusual behavior in cloud accounts and triggers alerts for review.

Machine-learning analytics monitor cloud accounts for anomalies and alert security staff within minutes.

Grafana and related tooling trigger alerts when predefined thresholds are exceeded, supporting availability SLAs.

Privileged activity records are protected from alteration, ensuring reliable audit trails for investigations.

Administrative users cannot modify or delete their own activity logs, ensuring trustworthy evidence for investigations or audits.

Amazon Inspector routinely assesses workloads for known CVEs, assigning risk scores that drive remediation.

Combined sensors detect anomalous activity at both host and network layers for comprehensive coverage.

Real-time dashboards track usage metrics and latency, helping teams act before performance issues arise.

Detection rules leverage industry feeds to spot known malicious IPs or behaviors before they impact customers.

Customers can view real-time uptime, latency and historical incident data for full operational transparency.

Privileged and data-access logs are periodically reviewed by security to confirm activity remains legitimate.

Cost, functionality, security, privacy and financial health are evaluated before onboarding any critical provider.

All service providers are cataloged and scored based on access level and criticality, guiding review depth.

All subprocessors are cataloged and scored based on data sensitivity and service criticality, guiding review depth and frequency.

All third parties are cataloged and scored based on access level and criticality to prioritize due diligence.

Critical vendors and subprocessors undergo yearly reassessment to confirm they still meet contractual and security requirements.

Key vendors provide independent audit reports or equivalent evidence that their controls meet company requirements.

Contracts and SOC reports are annually examined to verify that vendor controls align with company security and privacy requirements.

Terms of service, privacy policies and attestations are reviewed before onboarding and during annual reassessments.

NDAs are executed with all third parties before any confidential information is shared.

Agreements mandate that vendors uphold security, confidentiality, and privacy commitments consistent with customer expectations.

Core AI and infrastructure providers contractually agree not to store or retain customer inputs or outputs, preventing uncontrolled data propagation.

Management examines AWS SOC 2 attestations each year to validate complementary controls remain effective.

Contracts with foundational model vendors forbid storing or reviewing customer data, eliminating secondary exposure.

Cloud hosting and other critical providers are continuously evaluated against a shared-responsibility model to confirm alignment.

An up-to-date list of authorized subprocessors is available to customers, supporting informed risk decisions and compliance obligations.

Documented monitoring ensures complementary controls at subservice providers support Wolfia’s own commitments.

Customers receive transparency into all subprocessors so they can evaluate downstream risks.

Vendor agreements include binding confidentiality and privacy obligations aligned with customer requirements.

All customer information is managed at the highest protection tier, avoiding lower-class segregation.

Customer agreements and the public trust center clearly state the company’s obligations for protecting private information.

Comprehensive documents define roles, responsibilities, and safeguards for personal data processing in line with global regulations.

Data is promptly erased upon customer request and automatically purged when contractual retention limits expire.

Verified requests are fulfilled promptly, giving individuals control over their information and demonstrating regulatory compliance.

Information is kept only as long as necessary, with secure deletion processes triggered by schedule or customer request.

Formal guidelines ensure information is destroyed safely once it is no longer required.

Customer content is never used to improve generalized models unless a bespoke contract explicitly authorizes it.

All data is treated as confidential unless explicitly classified otherwise, ensuring conservative safeguards by default.

All customer data is handled as highly sensitive, eliminating the risk of lower-tier protections and simplifying compliance reviews.

Sensitive datasets are segregated into dedicated storage locations to enforce tailored access and retention rules.

Clients may choose default, shortened or ephemeral retention modes to align with their compliance requirements.

Customers may request alternate storage locations, supporting jurisdictional requirements without compromising security controls.

Security objectives, commitments and documentation are published so customers can easily verify privacy practices.

All processing and storage defaults to US regions, with alternative regions available on request.

Pre-employment screening verifies candidates’ trustworthiness before granting any system access.

Every employee completes training at hire and annually thereafter to stay current on threats and responsibilities.

Candidates undergo reference and suitability screening aligned with role risk before gaining access to systems.

Interview, reference, and other checks are completed before onboarding to verify trustworthiness relevant to job duties.

All personnel refresh their knowledge of threats, policies, and secure practices each year, fostering a security-first culture.

Candidates undergo reference verification proportional to role sensitivity before gaining access to systems.

Employees and contractors formally commit to protecting proprietary and customer information.

Employees must read and sign the code of ethics and information security program on hire and annually thereafter.

Mobile-device management enforces encryption, patching, and endpoint detection across all corporate devices.

Personnel must read and sign the code of conduct and information security program on hire and annually.

MDM enforces encryption, strong passwords, screen-lock and EDR software on every corporate endpoint.

Workstations are required to have current patches, antivirus, and mobile-device management enforcement before connecting to resources.

Security responsibilities are embedded in job descriptions and annual reviews, ensuring individual accountability for control adherence.

Laptops must run up-to-date OS patches, antivirus software and full-disk encryption before connecting to production resources.

Annual evaluations incorporate security responsibilities, reinforcing individual accountability for controls.

Managers formally evaluate each team member’s adherence to security responsibilities, reinforcing accountability.

A comprehensive continuity strategy defines procedures, roles and recovery objectives for critical services.

Recovery objectives, roles, and step-by-step procedures are defined and reviewed annually to ensure readiness.

Plans outline recovery objectives, roles, and communication steps to maintain critical operations during adverse conditions.

Business continuity and disaster recovery procedures are reviewed, approved and tested every year.

Backup restoration and continuity drills validate that critical data and services can be brought back within target timeframes.

Recovery procedures and backups are exercised yearly to confirm they meet recovery time and point objectives.

The platform runs in fault-tolerant cloud zones so a regional outage does not disrupt operations.

Customer data is backed up automatically, encrypted and monitored for successful completion.

System data is backed up every day and replicated to separate zones, protecting against data loss and local failures.

Data replicas reside in distinct zones so information remains recoverable even if a region experiences an outage.

Annual restore tests verify backups can be successfully recovered when needed.

Periodic restore tests confirm that backup data can be successfully recovered when needed.

A dedicated cyber policy provides financial resilience against business interruptions and incident-related costs.

Financial coverage is in place to offset operational and customer impacts of severe security incidents or outages.

Production data is continuously replicated to separate zones, reducing RPO to near-zero.

The organization identifies disruption risks and develops mitigations as part of its broader risk management program.

Customers can track historical availability and incident reports, underscoring transparency and reliability.

A signed amendment with OpenAI mandates that customer content is neither stored nor used for human review.

Production AI models are not trained on customer inputs or outputs, eliminating cross-tenant data leakage and intellectual-property exposure.

Models are not trained on customer content unless an exclusive, customer-requested arrangement exists.

Foundational model partners are contractually bound to discard all prompts and outputs after processing and to prohibit human review.

Inference workloads run within United States regions, helping customers satisfy strict data-residency or export-control requirements.

Each AI use case undergoes provider review, and scope changes require re-approval to maintain low risk.

Organizations that require bespoke models can opt for a separate training track with contractual assurances of isolation and data ownership.

Contracts forbid AI partners from manually inspecting any customer inputs or outputs, protecting confidentiality.

Management documents threats, impact and mitigation strategies at least once per year to guide control priorities.

Documented methodology identifies, scores, and tracks risks, ensuring mitigation strategies receive appropriate resources.

A cross-functional team reassesses emerging risks each quarter to keep the program aligned with a changing landscape.

Security leadership meets every quarter to review emerging threats and adjust controls, maintaining relevance as the business evolves.

Evaluations consider incentives, opportunities, and potential fraud scenarios, embedding anti-fraud measures into the control framework.

Risk assessments explicitly consider incentives, opportunities and attitudes that could lead to fraud or misconduct.

New controls are chosen and adapted based on quantified risk ratings, ensuring resources focus on greatest exposures.

Risk assessment results directly inform which new technical and procedural controls are designed each year, tying investments to real threats.

Financial risk is further mitigated through a dedicated cybersecurity insurance policy.