Security and Privacy at Wiiisdom
At Wiiisdom, we prioritize security and compliance. We implement and monitor policies and controls to ensure the safety of our customers’ and employees’ data.
Strict Access Control: Access is regulated based on the principle of least privilege.
Comprehensive Security Measures: Security controls are applied across all areas of the company.
Continuous Improvement: Policies and controls are iteratively developed to continuously enhance their effectiveness.
Security and Compliance at Wiiisdom
To demonstrate our commitment to security and compliance, we maintain a SOC2 Type II attestation. You can access our SOC2 Type II report in our Trust Center.
Wiiisdom contractually commits to comply with EU and US laws with GDPR, CCPA and applicable local data protection regulations.
Data Protection
Data at Rest
All data storage systems are encrypted at rest (AES-256). Sensitive data undergoes additional encryption at the field level, with keys held in a tenant-dedicated Azure Key Vault.
Data in Transit
Wiiisdom employs TLS 1.2 or higher for all data transmissions over potentially insecure networks, with TLS 1.3 enforced for HTTPS traffic. We utilize features such as HSTS to enhance the security of our data in transit. Server TLS keys and certificates are managed by Azure and deployed via a CDN.
Secret Management
Encryption keys and application secrets are managed through Azure Key Vault, with a dedicated key vault for each customer tenant. Access to keys and secrets is strictly limited to authorized services and a restricted Operations team, in accordance with Wiiisdom’s Cryptography Policy.
Data Act: Protection of Non-Personal Data
Infrastructure and jurisdictions
Wiiisdom Cloud Platform is hosted on Microsoft Azure. Each customer tenant is deployed in a dedicated Azure subscription, in the region agreed with the customer: North Europe (Ireland), Central US, West US or Canada Central. The tenant’s application services, database, storage accounts, key vault and user directory are all in that subscription. Database backups are geo-redundant and are replicated to the Azure paired region of the tenant’s region (for example, West Europe (Netherlands) for North Europe). A few services shared across tenants are run from a central Wiiisdom Azure subscription:
- the entry point and web application firewall (Azure Front Door), a globally distributed Azure service;
- when AI features are enabled, the AI services (Azure AI Foundry) and the storage of anonymised AI traces, hosted in Sweden Central. Operational monitoring data (metrics and traces) is processed by Grafana Labs (Grafana Cloud, EU Germany). User accounts for Wiiisdom Cloud Platform are stored in the customer tenant. Accounts for Wiiisdom’s support portal (Wiiisdom ID / Customer Center) are stored only in Okta (Auth0), hosted in the United States. Wiiisdom’s contracting entities are established in France, the United States, Canada and the United Kingdom. The list of sub-processors is available upon request at dpo@wiiisdom.com.
Measures against unlawful third-country access
Wiiisdom implements technical, organizational and contractual measures to prevent access to or transfer of non-personal data held in the EU where this would conflict with EU or Member State law. These include:
- tenant isolation in dedicated Azure subscriptions and virtual networks, with databases, storage and key vaults reachable only through private endpoints;
- encryption at rest (AES-256) and in transit (TLS 1.2 or higher), with sensitive data additionally encrypted using keys held in a tenant-dedicated Azure Key Vault;
- access restricted to a limited Operations team with no direct access to data layers, and alerting on privilege elevation;
- reliance on the contractual commitments of our cloud provider regarding government access requests. Wiiisdom will notify the customer of any third-country government request concerning its data, unless legally prohibited.
Product Security
Penetration Testing
Wiiisdom conducts penetration testing to ensure the security and resilience of its applications and systems. These tests are performed internally at least twice a year, following OWASP standards, including the Web Testing Guide v4.2 and ASVS.
The goal is to identify and assess vulnerabilities that could affect the integrity, confidentiality, and availability of data and services provided by Wiiisdom’s applications. Additionally, Wiiisdom engages an independent penetration testing firm to test externally facing assets at least once a year. More information and test results can be found on our Trust Center.
Vulnerability Scanning
Wiiisdom’s Secured Software Development Lifecycle (SSDLC) incorporates vulnerability analysis at multiple stages of the cycle.
We perform:
- Static Application Security Testing (SAST) at the pull request level.
- Software Composition Analysis to detect and address vulnerabilities in third-party dependencies.
- Dynamic Application Security Testing (DAST) on live applications.