SECURITY POLICY

Security & Technical and Organisational Measures (TOM)

WiseWare.chat SaaS Platform

WiseWare BV - Security Policy Version 1.3 - August 11, 2026

This document describes the technical and organisational measures (TOM) WiseWare applies to protect customer data on the WiseWare.chat platform. It is structured along the control themes of ISO/IEC 27002:2022 (organizational, people, physical, and technological controls) and serves as WiseWare’s TOM description under Article 32 GDPR.

1. SCOPE, GOVERNANCE & RISK MANAGEMENT

Ownership: Security is owned at founder/management level. A named role (the ISMS Lead) is responsible for maintaining the security programme, and security is a standing item in engineering planning and review.
ISMS: WiseWare maintains an internal Information Security Management System (ISMS) structured on ISO/IEC 27001:2022, covering the operation of the WiseWare platform and the processing of customer data. WiseWare is working toward ISO/IEC 27001 certification.
Scope: This policy covers the WiseWare.chat SaaS platform and the processing of customer data on it. This document summarises the measures from the ISMS; detailed internal documentation is available to customers and their assessors on request under NDA.
Risk management: WiseWare performs security risk assessments at least annually and on material changes to the platform, architecture, or supplier chain. Risks are recorded in a risk register with owners and treatment decisions, maintained as part of the ISMS.

2. ORGANIZATIONAL CONTROLS

2.1 Cloud Infrastructure & Hosting

Private cloud environment: WiseWare operates on a European private cloud with managed container orchestration, operated by an EU cloud provider (see the Sub-processors Registry); databases run on this platform as operator-managed PostgreSQL.
Infrastructure as Code (IaC): All infrastructure and configuration is defined in code, version-controlled, and subject to review. This ensures consistency, auditability, and reduces the risk of human error.
No manual operations: Servers, clusters, and services are not configured or modified by hand. Changes go through peer review and automated deployment pipelines.
Network protections: Built-in anti-DDoS and traffic filtering are provided at the infrastructure level.
GDPR compliance: All hosting and processing takes place in the EU/EEA and is operated in accordance with the General Data Protection Regulation (GDPR).

2.2 Supplier & Sub-processor Security

All sub-processors are located in the EU/EEA and are listed in the public Sub-processors Registry, including AI model providers and their EU endpoints.
Contractual safeguards: data processing agreements are in place with all sub-processors, providing safeguards consistent with Article 28 GDPR. For major cloud and AI providers these are based on the provider’s standard data processing terms; WiseWare reviews those terms against its obligations to customers.
AI model providers: all AI model inference is performed via EU API endpoints. No Customer Data is transferred outside the EU/EEA for inference, and no Customer Data is used to train external AI models.
Supplier review: sub-processors are reviewed on onboarding and on material changes to the supplier chain.

2.3 Incident Management

WiseWare maintains an incident response procedure covering detection, assessment, containment, remediation, and post-incident review.
Customer notification: if a security incident affects customer data, we notify affected customers without undue delay, and in any event within 72 hours of becoming aware of a personal-data breach, in line with GDPR.
Every significant incident receives a post-incident review; lessons feed back into the security programme.

2.4 Backup, Business Continuity & Disaster Recovery

Automated, encrypted backups are enabled by default.
Backups run continuously, allowing for point-in-time recovery (PITR) within the defined retention window.
Data can be restored to an exact moment in time, minimizing potential data loss in the event of an incident.
Backups are stored in separate, encrypted storage systems, isolated from the live service.
Backup integrity is monitored daily to ensure restorability.
Recovery objectives: for the primary database, point-in-time recovery supports a recovery point objective (RPO) measured in minutes. Our target recovery time objective (RTO) for full service restoration is 24 hours; in most scenarios recovery is significantly faster.
Restore testing: backup restoration is tested at least annually.
Continuity: WiseWare’s infrastructure is fully defined as code, so the platform can be rebuilt from version-controlled configuration in a new environment if the primary environment is lost.
Supplier continuity: exit and data export arrangements, including a minimum three-month notice period if the Services are discontinued, are laid down in the Master Subscription Agreement.

2.5 Data Retention & Secure Deletion

Retention per data type: retention periods for user profiles, AI agent configurations, session data, files, and generated metadata are specified in the Data Processing Agreement (Section 11).
Customer-controlled deletion: customers can delete their data at any time through the platform.
On termination: customers have 30 days to export account data. After the export period, WiseWare deletes Personal Data, except where retention is required by law.
Backups: residual data in backups is overwritten in the ordinary course of backup cycles.

3. PEOPLE CONTROLS

All personnel with access to production systems or customer data are bound by confidentiality obligations in their contracts.
Pre-employment screening (reference checks) is performed within the limits of Dutch law.
Access follows least privilege and is revoked promptly on role change or departure.
Personnel receive security awareness training at onboarding and periodically thereafter.

4. PHYSICAL CONTROLS

WiseWare operates no physical offices or on-premise servers; the workforce is fully remote and the physical security boundary is provided by the cloud provider’s data centers.
Provider assurances: data centers hold international security certifications (including ISO 27001, ISO 27017, ISO 27018) and have passed SOC 1 and SOC 2 type II audits.

5. TECHNOLOGICAL CONTROLS

5.1 Access & Identity Management

Customer-facing identity:

Sign-in options: email + password, passwordless magic links, and single sign-on via Google and Microsoft (OpenID Connect). Each organisation controls which sign-in methods are enabled for its users.
Two-factor authentication: TOTP-based 2FA with recovery codes is available to all users. Organisations can require 2FA for password-based sign-in.
Password handling: passwords are hashed with bcrypt and never stored or logged in plaintext. Changing a password requires the current password and terminates all other active sessions.
Session management: sessions are backed by server-side tokens that are validated on every request, so access can be revoked immediately — a signed-out or disabled session cannot continue to be used.

Internal access:

Infrastructure access is limited to authorized WiseWare engineers.
All access requires multi-factor authentication (MFA) and is logged.
Roles and permissions are configured according to the least privilege principle.

5.2 Data Protection & Encryption

Encryption in transit: TLS 1.2+ for all client and service communications.
Encryption at rest: All databases and storage volumes are encrypted (AES-256).
Encrypted backups: Backups are encrypted and stored in separate storage systems (see Section 2.4).

5.3 Tenant & Data Isolation

Schema-level database isolation: every customer organisation has its own dedicated PostgreSQL schema. Customer data is not stored in shared tables — isolation is structural, not just a filter in application code.
Hostname-scoped access: each organisation is served on its own domain, and every request is bound to that organisation’s schema based on the hostname. Requests for unknown hosts are rejected outright.
Default-deny authorization: within each tenant, access is governed by declarative authorization policies with a default-deny posture — access must be explicitly granted by role, ownership, or workspace membership.
Isolated file storage: uploaded files are stored under tenant-scoped paths in EU object storage, are not publicly accessible, and are served only via short-lived signed URLs.
Isolation testing: automated regression tests covering cross-tenant access run in CI on every change.

5.4 Application Security & Secure Development

Centralized access control: Authorization rules are defined in a unified policy layer and enforced consistently across all interfaces (API, web, and service-to-service), preventing gaps between endpoints.
Consistent enforcement: A single source of truth for permissions reduces the risk of misconfiguration.
Defense in depth: Input validation, rate limiting, and session handling are built into the application stack.
Modern runtime safety: The underlying application platform enforces immutability and concurrency safety, reducing classes of common vulnerabilities (e.g., race conditions, shared state issues).
Secure development lifecycle: All changes are version-controlled and peer-reviewed before merge, supported by automated static code analysis. Deployment is fully automated through CI/CD pipelines — there is no manual path to production.

5.5 Vulnerability & Patch Management

Automated dependency scanning runs continuously on all application dependencies and container images; findings are triaged as part of the regular development workflow.
Triage SLAs: vulnerabilities rated critical are triaged within 48 hours and remediated or mitigated as a priority, typically within 7 days. High-severity findings are addressed within 30 days; lower severities within normal release cycles.
Infrastructure patching: the cloud provider patches the underlying platform (operating systems and container orchestration) as part of the managed service; WiseWare applies database and application updates through its version-controlled CI/CD pipeline.
AI provider advisories: security advisories from AI model providers are monitored and assessed like any other dependency.

5.6 Logging & Monitoring

Infrastructure and application logs are monitored for unusual activity.
Application performance monitoring and error tracking are in place (see the Sub-processors Registry).
Access to production systems is logged.
Both provider-level and WiseWare monitoring are in place.

6. TESTING & EFFECTIVENESS OF CONTROLS

Continuous automated testing: automated dependency scanning, static code analysis, and cross-tenant access regression tests run on every change; we are extending our automated analysis toolchain. Details of the tooling in use are documented internally and available on request.
Peer review: every change is reviewed before merge.
Always-open external channel: our vulnerability disclosure programme (Section 9) provides a continuously open route for external security researchers to report findings.
Independent assessments: security testing is continuous rather than calendar-driven. Independent technical assessments are commissioned on a risk basis — for material architectural changes and for critical components such as tenant isolation — rather than as a fixed annual exercise. Summaries of independent assessments are available to customers on request.

7. SHARED RESPONSIBILITY

Cloud provider secures: physical infrastructure, networking, and managed services (including patching and control planes).
WiseWare secures: application layer, workload configuration, access policies, and customer data governance.
Customer secures: user account credentials, organisation-level authentication settings (such as enabled sign-in methods and 2FA requirements), and the data and access it grants to its own users.

This policy is part of a set of public documents:

Data Processing Agreement — roles, data categories, retention, and sub-processor terms.
Sub-processors Registry — all sub-processors, including AI model providers and EU endpoints.
Service Level Agreement — availability and support commitments.
Master Subscription Agreement — contract terms, including exit and supplier continuity arrangements.

Detailed internal documentation — architecture and data-flow descriptions, the incident response procedure, and business continuity plans — is available to customers and their assessors on request under NDA.

9. VULNERABILITY DISCLOSURE

We welcome reports of security issues:

Email [email protected].
Please include steps to reproduce if possible.
We aim to respond within 48 hours.
Do not publicly disclose until we’ve confirmed a fix.

WiseWare BV Utrecht, Netherlands KvK: 98236652 Version 1.3 - August 11, 2026

This Security Policy applies to all users of WiseWare.chat and outlines our commitment to protecting customer data and maintaining platform security. By using the platform, you acknowledge and understand the security measures we have implemented.