Customers can enforce their own identity policies through SAML 2.0 and OpenID Connect, allowing corporate MFA, conditional access, and streamlined user lifecycle management.

Directory sync lets customers provision, update, and deprovision their users automatically from their identity provider.

Role-based access control maps permissions to job function so each user receives only the access they need.

New users receive documented approval before accounts are created and departing users have all access disabled within one business day, eliminating orphaned credentials.

Production environments may only be reached through approved encrypted channels, safeguarding credentials and session data in transit.

Documented reviews of all production accounts verify that privileges remain appropriate and any unnecessary access is removed.

Employee access to internal systems requires single sign-on with enforced multi-factor authentication, and customers can require their own identity provider for their users.

Customer data, temporary files and backups are protected with strong AES-256 encryption whenever stored on disk.

Secure transport protocols are mandated for all external and internal transfers, preventing eavesdropping over public networks.

Customer data is deleted within 30 days of contract termination or a verified deletion request, and encrypted backups age out within 90 days, as committed in the Data Processing Agreement.

Company-issued laptops are required to use whole-disk encryption, preventing data loss if a device is lost or stolen.

Information is labeled as secret, confidential, internal, or public, enabling appropriate handling, retention, and disposal according to sensitivity.

Documented standards embed security requirements throughout design, coding, testing, and deployment activities.

Static code analysis and secret scanning run automatically on every change before it can be merged.

Dependencies and container images are automatically scanned for known vulnerabilities on every change, and patches are applied promptly.

Independent security experts test the web application and API at least annually. The most recent test closed with zero open findings after remediation, and the report is available under NDA.

A managed WAF blocks common web threats and combined DDoS protection keeps the service available even during volumetric attacks.

Secret scanning runs on every commit, and any exposed credential is rotated promptly.

All application containers are built from approved sources and stored in a private registry to block malicious code insertion.

Changes reach production only through pull requests to a protected branch that must pass automated security and quality checks before they can be merged.

Cloud-native threat detection continuously analyzes account, network, and audit activity and alerts the security team.

Production runs across multiple availability zones, with backups copied to a second region for disaster recovery.

Production systems run in private networks. Only required inbound ports are exposed, and databases and the cluster control plane are not reachable from the internet.

Production resources reside in isolated subnets so internal services are not directly exposed to the internet.

Infrastructure and platform configuration are defined as code, reviewed before deployment, and continuously reconciled against the approved state.

Encrypted backups run daily with continuous point-in-time recovery and are copied to a second geographic region so data can be restored after a regional outage.

The platform automatically provisions resources and distributes traffic as usage grows, maintaining performance without manual intervention.

Clear playbooks define roles, escalation paths and customer notification procedures for security events.

Table-top and drill exercises test the plan each year, driving improvements from real-world lessons.

Monitoring tools send immediate notifications to dedicated channels, ensuring swift human review of potential incidents.

All incidents are logged and tracked to closure, providing auditable evidence of timely remediation.

All incident workflows include collecting and safeguarding logs and artifacts to support forensic analysis and reporting.

Post-incident reviews identify systemic issues and feed improvements back into the security program.

Trained personnel are on call to triage, contain, and communicate security incidents, ensuring rapid, coordinated action.

A licensed CPA firm verified that controls for security, availability, and confidentiality were designed and operated effectively throughout the audit period.

Management reviews each security control yearly to verify effectiveness and document remediation actions.

A compliance management platform tracks control ownership and evidence collection for the SOC 2 program.

Senior management formally re-evaluates and signs off on the information security program every year to keep it current.

Security researchers can report vulnerabilities to security@wolfia.com under the published disclosure policy, and reports are triaged and remediated by the security team.

Cyber liability insurance is in place, and the certificate of insurance is available on request.

Application and infrastructure logs are centralized and retained per policy for audit and investigation.

System, application, and access logs flow into a unified platform that supports searching, correlation, and retention.

Automated tools analyze logs and metrics for anomalies, sending high-fidelity alerts to security staff.

Threshold-based alerts on availability and latency notify the on-call engineer.

Administrative users cannot modify or delete their own activity logs, ensuring trustworthy evidence for investigations or audits.

Workloads and container images are continuously scanned for known vulnerabilities and remediated according to risk.

Customers can view real-time uptime, latency and historical incident data for full operational transparency.

Cost, functionality, security, privacy and financial health are evaluated before onboarding any critical provider.

All subprocessors are cataloged and scored based on data sensitivity and service criticality, guiding review depth and frequency.

Critical vendors and subprocessors undergo yearly reassessment to confirm they still meet contractual and security requirements.

Contracts and SOC reports are annually examined to verify that vendor controls align with company security and privacy requirements.

Agreements mandate that vendors uphold security, confidentiality, and privacy commitments consistent with customer expectations.

Management reviews the cloud hosting provider's SOC 2 attestation each year to validate that complementary controls remain effective.

Every AI provider processes customer data under zero-data-retention and no-training terms; none stores, reviews, or trains on customer data.

The cloud hosting provider is the audited subservice organization in the SOC 2 Type II report. Other critical providers, including the AI inference providers, are covered by annual reviews of their SOC 2 Type II reports and data-processing terms. Additional providers are being evaluated for inclusion in the next audit period.

An up-to-date list of authorized subprocessors is available to customers, supporting informed risk decisions and compliance obligations.

All customer information is managed at the highest protection tier, avoiding lower-class segregation.

Customer agreements and the public trust center clearly state the company’s obligations for protecting private information.

Comprehensive documents define roles, responsibilities, and safeguards for personal data processing in line with global regulations.

Data is promptly erased upon customer request and automatically purged when contractual retention limits expire.

Verified requests are fulfilled promptly, giving individuals control over their information and demonstrating regulatory compliance.

Information is kept only as long as necessary, with secure deletion processes triggered by schedule or customer request.

Customer content is never used to improve generalized models unless a bespoke contract explicitly authorizes it.

Security objectives, commitments and documentation are published so customers can easily verify privacy practices.

All processing, storage, and AI inference run in United States regions. An alternate storage-at-rest location can be arranged on request under an enterprise agreement; AI inference remains in US regions.

Every employee completes training at hire and annually thereafter to stay current on threats and responsibilities.

Interview, reference, and other checks are completed before onboarding to verify trustworthiness relevant to job duties.

Employees and contractors formally commit to protecting proprietary and customer information.

Employees must read and sign the code of ethics and information security program on hire and annually thereafter.

Company devices are centrally managed with enforced disk encryption, screen lock, and automatic updates.

Security responsibilities are embedded in job descriptions and annual reviews, ensuring individual accountability for control adherence.

A comprehensive continuity strategy defines procedures, roles and recovery objectives for critical services.

Backup restores and continuity exercises are run at least annually and measured against the 24-hour recovery objective.

The organization identifies disruption risks and develops mitigations as part of its broader risk management program.

Foundational model partners are contractually bound to discard all prompts and outputs after processing and to prohibit human review.

Inference workloads run within United States regions, helping customers satisfy strict data-residency or export-control requirements.

Management documents threats, impact and mitigation strategies at least once per year to guide control priorities.

Documented methodology identifies, scores, and tracks risks, ensuring mitigation strategies receive appropriate resources.

A cross-functional team reassesses emerging risks each quarter to keep the program aligned with a changing landscape.

Evaluations consider incentives, opportunities, and potential fraud scenarios, embedding anti-fraud measures into the control framework.

New controls are chosen and adapted based on quantified risk ratings, ensuring resources focus on greatest exposures.