We hold no
certifications. Here is
what we actually do.
wrxstack encrypts data in transit with TLS 1.3 and at rest through its managed hosting provider, never uses customer content to train models, and holds no security certifications. No SOC 2. No ISO 27001. No FedRAMP. No HIPAA BAA. No penetration test. What follows is a plain description of how your data is stored, who can reach it, and what happens when you delete it.
Read this first.
Security pages exist to make you comfortable. This one exists to make sure you are not comfortable for the wrong reasons.
wrxstack is an independent product built by a small team. It has never been audited by a third party. No CPA firm has issued an attestation about it. No certification body has certified anything about it. No security firm has tested it.
Are you evaluating wrxstack for regulated data? Health records, cardholder data, government workloads, or anything covered by a compliance regime your organization answers for? Then the gaps listed below matter most: there is no certification, no BAA, and no third-party audit, so wrxstack is not suited to those workloads today.
If you are one person or a large organization storing ordinary business data, read on. The controls below are real, and we have described them without inflation. Organizations of any size can add SAML single sign-on, SCIM provisioning, custom roles, and audit logs on paid plans, and large organizations can buy on Enterprise custom terms. The enterprise page has the details.
The controls that exist.
Each item here is either something you can independently verify, or something a provider underneath us does under its own terms. This describes our current practice. It is not a warranty, and the Terms of Service govern the service.
Encryption
TLS 1.3 in transit on every domain, with HTTP redirected rather than served. Data at rest sits on managed storage with provider-level volume encryption.
- Verify the transit claim yourself with any SSL checker
- At-rest encryption is inherited from our host, not built by us
- We do not offer customer-managed keys, BYOK, or KMS integration
Identity and access
Sign-in is handled by Atlas at atlas.wrxstack.com. Passwords are stored as hashes, not in plaintext, and the system is designed not to write them to logs.
- Access to production is limited to the team that builds it
- SAML single sign-on is available on paid plans, with group-to-role mapping
- SCIM 2.0 provisioning is available on paid plans. Atlas supports custom roles and maps identity-provider groups to roles
- Two-factor sign-in is available. Turn it on for every account
AI and your content
We do not use your content to train any model. We use model providers on API tiers whose terms prohibit training on submitted data.
- Under the provider terms we use, prompts are not kept for training
- We do not fine-tune on customer content
- Sub-processors are listed on the sub-processors page
Dependencies and patching
We aim to update dependencies when security advisories are published. Automated dependency alerts are enabled on the repository.
- We do not run SAST, DAST, or container scanning in CI
- We have no patch deadline or SLA
- We have never commissioned a penetration test
Availability and backups
The application runs on managed hosting with automated database backups taken by the provider. There is no published SLA and no service credit scheme.
- Single region. No multi-region failover
- No disaster-recovery drill cadence, and no rehearsed restore
- Live checks on the status page, which measures rather than estimates
Retention and deletion
When you delete your account, we take reasonable steps to remove your data from the live database, subject to the exceptions in the retention policy. Provider backups age out on the provider's own rotation, which we do not control.
- Ask for an export before you delete; see the data export page
- Deletion requests to contact@wrxstack.com are handled as the data deletion policy describes
- Details in the privacy policy
Stated explicitly.
Absence of a claim is easy to miss. So rather than let you infer these from silence, here they are as a list. If a competitor's page lists any of these and ours does not, that difference is real.
| Capability | Status | What to do instead |
|---|---|---|
| SOC 2 / ISO 27001 report | Does not exist | Use a vendor that has one. See the Trust Center. |
| Signed BAA for PHI | Not offered | Do not store protected health information in wrxstack. |
| Penetration test summary | Does not exist | Nothing to request. |
| Completed CAIQ / SIG / HECVAT | Not maintained | Send yours. Where we answer, we answer honestly, including the blanks. |
| Customer-managed encryption keys | Not supported | Encryption keys are managed by our hosting provider. |
| Choice of data region | Not supported | Single region. Ask us which one before you sign up. |
| Single-tenant VPC, on-prem, air-gap | Not offered | Multi-tenant managed cloud is the only deployment. |
| Uptime SLA with credits | Not offered | Provided as is, with no uptime commitment. Watch the status page. |
| 24/7 on-call rotation | Does not exist | Incidents are handled by the team when available, not by a rota. |
| Paid bug bounty | Not funded | Report anyway to contact@wrxstack.com. With your permission, we may name you when we acknowledge a fix. No payment or reward is offered. |
"Is our data used to train your models?"
No. This is the question worth answering carefully, because it is the one where a vague answer does the most damage.
Not by us. Not by our providers.
wrxstack does not train, fine-tune, or evaluate models on your content. We call model providers through their commercial API tiers, whose terms prohibit training on submitted data. That prohibition is theirs to honor, and we cannot control how a provider meets its own terms.
Retention is set by the provider.
Under the provider terms we use, the provider may keep a prompt only to serve the request and for its own abuse-monitoring window. We do not have a negotiated zero-retention agreement, and we are not going to claim one.
Your content, so the product works.
Tasks, documents, and messages live in our database because that is what makes them retrievable. They are readable by the application, and in principle by whoever operates it. Encryption at rest protects the disk, not the query.
The vendors we list.
Mainly the hosting provider, and the model provider for the specific text you send to an AI feature. Our sub-processors are listed on the sub-processors page. We do not sell data and we have no advertising business.
Do not use the AI features.
AI features are designed to send content to a model provider only when you use them. If you never invoke an AI feature, your content is not sent to a model provider for that purpose.
Supported in Atlas.
You can connect your own model-provider key or a compatible endpoint to power the Atlas assistant. When you do, your content goes to the provider you chose, under your own agreement with that provider, and that provider's terms govern how it handles your content. We are not responsible for a provider you choose.
Frequently asked questions.
The questions a security reviewer actually asks, answered without spin. Where the answer is no, it says no.
Is my data encrypted in transit and at rest?
Yes. Every request is served over TLS 1.3, and HTTP is redirected rather than accepted, so you can confirm the transit claim with any SSL checker. Data at rest sits on managed storage with provider-level volume encryption. The at-rest encryption is inherited from our hosting provider, not something we built, and we do not offer customer-managed keys.
Is my content used to train AI models?
No. wrxstack does not train, fine-tune, or evaluate any model on your content. We call model providers on their commercial API tiers, whose terms prohibit training on submitted data. AI features are designed to send content to a model provider only when you use them. If you connect your own model, that provider's terms apply instead.
Do you support single sign-on and SAML?
Yes. SAML single sign-on is available on paid plans, with group-to-role mapping. Sign-in is handled by Atlas at atlas.wrxstack.com, passwords are stored as hashes and the system is designed not to log them. On paid plans Atlas supports SCIM 2.0 provisioning, with the SCIM token created by a workspace owner in the single sign-on settings. Atlas supports custom roles and maps identity-provider groups to roles.
Is there an audit log?
Yes. Atlas records administrative and security-relevant actions in an in-app audit log so workspace owners can see who did what and when. Entries are chained together, so an owner can run Verify chain to confirm that no entry was changed or removed. There is no SIEM streaming. Access to production is limited to the core engineering team.
How do I export or delete my data?
Ask for an export before you delete. When you delete your account, we take reasonable steps to remove your data from the live database, subject to the exceptions in the retention policy. Provider backups age out on the provider's own rotation, which we do not control. Requests go to contact@wrxstack.com, and we handle them as the law and our data export and data deletion policies describe.
What security certifications do you hold?
None. wrxstack holds no SOC 2, no ISO 27001, no FedRAMP, and no HIPAA BAA, and it has never had an independent penetration test. If your review requires an attestation, wrxstack cannot provide one today. You may send your questionnaire. Where we answer it, we answer honestly, including the blanks.
Can you store regulated data like health or cardholder records?
No. We do not sign a BAA, so do not store protected health information in wrxstack. Payments, if any, are handled by a third-party processor, and card data is entered with that processor, not stored by us. For anything covered by a compliance regime your organization answers for, choose a vendor that carries the matching attestation.
Send your questionnaire.
We answer the blanks too.
Including the ones where the answer is no. A security review of wrxstack should be short, and it should end with an accurate picture rather than a favorable one.