What we can prove.
And what we cannot.
wrxstack is an independent company. We hold no security certifications. Rather than imply otherwise with badges, this page states exactly where we stand, what we actually do with your data, and who else touches it.
No badges we have
not earned.
Security certifications are audits, not adjectives. Each one below requires an accredited third party, a defined observation window, and a real fee. We have not been through any of them. If a vendor page tells you otherwise about us, it is out of date.
| Framework | What it requires | Our status |
|---|---|---|
| SOC 2 Type I / II | Attestation by a licensed CPA firm over an observation window | Not held. No audit has been performed. |
| ISO/IEC 27001 | Certification by an accredited certification body | Not held. No ISMS has been certified. |
| ISO/IEC 27017, 27018 | Extensions to a certified ISO 27001 ISMS | Not held. |
| FedRAMP | Federal agency sponsor and a 3PAO assessment | Not held. No sponsor, no assessment, not in process. |
| HIPAA / HITECH | A signed BAA and the safeguards of 45 CFR 160 and 164 | We do not offer a BAA. Do not put PHI in wrxstack. |
| PCI DSS | QSA assessment or a completed self-assessment questionnaire | Not applicable. Payments, if any, are handled by a third-party processor, and card data is entered with that processor, not stored by us. |
| CSA STAR, HITRUST | Registry submission or validated assessment | Not held. Not submitted. |
| Independent penetration test | An engagement with a security firm | None performed. We have never commissioned one. |
| GDPR / UK GDPR | A legal obligation, not a certificate anyone issues | We are subject to it and describe our handling in the privacy policy. |
| CCPA / CPRA | A legal obligation, not a certificate anyone issues | We do not sell or share personal information as the CCPA defines those terms. See the CCPA statement. |
GDPR and CCPA sit apart from the rest of this table on purpose. They are laws that apply to us whether or not we do anything about them, and no body issues a certificate for either. Every other row is a badge that must be granted by someone else, and nobody has granted us one.
The short, verifiable list.
Everything here is something you can check yourself, or something the providers underneath us do under their own terms. It describes current practice, not a warranty; the Terms of Service govern the service.
Encrypted in transit
Requests to wrxstack.com, atlas.wrxstack.com, and portfolio.wrxstack.com are served over TLS. HTTP is redirected, not accepted. You can confirm this from your browser's address bar or with any SSL checker.
REST
Encrypted at rest
Application data is stored on managed infrastructure with volume-level encryption at rest enabled by the provider. This is inherited from our host, not something we implemented, and we will not claim more than that.
TRAIN
Your content does not train models
We do not train any model on your content. The model providers we use offer API tiers whose terms prohibit training on submitted data. That rests on the provider's terms, which we do not control. If you connect your own model, your provider's terms apply.
Access controls in Atlas
Atlas has two-factor sign-in, Google and GitHub sign-in, and role-based access. On paid plans it adds SAML single sign-on, SCIM 2.0 provisioning, custom roles, group-to-role mapping, and audit logs you can review and export. Data loss prevention is on the higher paid plans. These are product features, not third-party attestations.
Things we deliberately do not claim: customer-managed encryption keys, a choice of data region, single-tenant deployment, on-premise or air-gapped installation, a 24/7 on-call rotation, a formal vulnerability management SLA, background checks, or a disaster-recovery drill cadence. None of those exist here today.
Who else touches it.
A short summary of the main third parties involved in running wrxstack. The sub-processors page is the current list, and it controls if this summary differs from it.
| Vendor | Purpose | What it receives |
|---|---|---|
| Render | Application and site hosting | All application data, at rest and in transit |
| PostHog | Product analytics on the marketing site | Page views, coarse device and country data |
| Google Tag Manager | Analytics tag loading | Page load events |
| FormSubmit | Contact form delivery | Whatever you type into the contact form |
| Model provider | AI features only | The content you send to an AI feature, when you use it |
Tell us, and we will look at it.
We aim to read every report, reply as a human, and fix confirmed issues. With your permission, we may name you when we acknowledge a fix. This is not a paid programme, and we offer no payment, reward, or other compensation.
What happens when it breaks.
We have no incident history to publish. There is no archive of postmortems here because there is nothing yet to put in it, and we are not going to pad the page with drills and maintenance windows to make it look lived-in. Here is how we intend to handle the first real one. The incident notification policy has the detail.
The honest version is shorter.
Most trust centers are designed to get a procurement checklist ticked. Ours is designed so that nothing on it can be contradicted by someone who checks.
We will not invent a report.
If your security review requires a third-party attestation, we do not have one today, and we will not manufacture one. Large organizations can talk to us about the Enterprise plan's custom terms through Atlas contact sales. Send your questionnaire and we will answer each item plainly.
Do not put it here.
We will not sign a BAA. Signing one without the safeguards behind it would transfer real legal liability to us and give you a false sense of protection.
This page will say so.
If wrxstack ever completes an audit, we intend to name it here. Until then, this table says no.
Frequently asked questions.
Where your data lives, who else touches it, and what happens when something goes wrong.
Where is my data hosted?
On Render, our application and site host, in a single region. Data lives on managed database and object storage with provider-level encryption at rest. You cannot choose a region, so ask us which one before you sign up if that matters to you.
Who are your sub-processors?
The main ones are Render for hosting, PostHog and Google Tag Manager for site analytics, FormSubmit for contact-form delivery, and the model provider for text you send to an AI feature. The sub-processors page is the current list.
Is there an uptime SLA?
Nothing on this site commits to an uptime figure or to compensation for downtime. The service is provided as is, as the Terms of Service describe, on managed hosting. Any custom Enterprise terms are agreed in writing with that customer. The status page checks the site, Atlas, and Folio from your browser in real time, reporting what it observes rather than a headline number.
How do you handle incidents?
We follow the breach notice rules the law sets. Under the GDPR, that means notifying the supervisory authority within 72 hours where feasible, and telling affected people without undue delay where the risk to them is high. Where we tell you, we do it directly, usually by email. The incident notification policy has the detail. We have no incident history to publish yet.
How do I report a security vulnerability?
Email security@wrxstack.com and include the affected URL, the steps to reproduce, and what you were able to access. We aim to acknowledge it as a human, not an autoresponder, and with your permission we may name you when we acknowledge a fix. Good-faith research that follows the responsible disclosure policy is covered by that policy's safe harbor, on its terms.
Do you run a paid bug bounty?
No. This is responsible disclosure, not a paid programme, and we offer no payment, reward, or other compensation. Report the issue anyway. We aim to read every report, reply as a human, and fix confirmed issues.
What certifications does wrxstack hold?
None. No SOC 2, no ISO 27001, no FedRAMP, no HIPAA BAA, and no independent penetration test. GDPR and CCPA are laws that apply to us regardless, and we describe our handling in the privacy policy. If a vendor page claims a certification for us, it is out of date.
Ask us anything.
We aim to answer plainly.
Security questions, data-handling questions, questions about what happens to your content. Email a human. Where we answer, and the answer is "we don't do that," that is what you will get.