Compliance
Wavey does not currently claim SOC 2, ISO 27001 or AIUC-1 certification. GDPR duties depend on how Wavey and its providers process data.
Security, privacy and transparency
Wavey Trust Center
We build Wavey with security and privacy in mind. Here you can see the controls that are available today, how data is handled and which capabilities are still being developed.
Security at a glance
Security scans
Publishing checks for critical exposed secrets. Pro and Business can run an AI code review; Business can schedule recurring reviews.
Access and data
Supabase handles sign-in and Wavey project storage. Team access uses the roles currently available in your plan; SAML SSO and SCIM are not available.
What we can verify today
This page describes Wavey's current implementation. It is not an audit report, certification, guarantee of security, or penetration test. We will update this page as Wavey's controls change.
Useful resources
Security controls
Publishing guardrails
Wavey checks project source for selected critical exposed credentials and blocks publishing when a critical match is found.
AI code review
A connected Wavey AI model can review saved project files for common security concerns. This is an automated review, not a penetration test.
Recurring reviews
Business workspaces can schedule weekly or monthly AI reviews for published sites. A Cloudflare Cron Trigger and the Supabase setup SQL are required.
Secrets and connectors
Connector credentials are encrypted by the Worker. Do not put private API keys in prompts or generated frontend code.
Data location
Wavey does not offer a per-customer region selector. Storage and AI processing locations depend on the configured provider and its settings.
Enterprise identity controls
SAML SSO, SCIM provisioning, customer-managed encryption keys and private-cloud deployments are not currently available.
Subprocessors
Wavey uses service providers to run the product. Processing locations and retention follow each service's configuration and terms; Wavey does not offer a single global region setting.
Cloudflare
Worker runtime, website delivery and DNS routing.
Location depends on Cloudflare service and routing.Supabase
Account authentication, database and project storage.
Database region is set in the Wavey Supabase project.Stripe
Subscription checkout and billing management.
Payment processing follows Stripe's settings and terms.Configured AI provider
Processes prompts, code reviews and generation requests for the model selected by Wavey.
The provider and applicable terms depend on Wavey's configuration.Frequently asked questions
Is Wavey SOC 2 or ISO 27001 certified?
No. Wavey does not currently claim these certifications. This page will be updated if that changes.
Does Wavey store my private AI provider key?
Customers choose from AI models configured by Wavey. Private keys used by Wavey are kept server-side. Never paste secret keys into a project prompt.
Can I choose where my project data is stored?
There is no per-workspace location selector yet. The Supabase project and AI provider configuration determine the applicable locations.
Is a security scan a guarantee that my site is secure?
No. It checks for selected common issues and can miss vulnerabilities. Arrange an independent security test for high-risk projects.
Does Wavey provide SSO, SCIM or private-cloud hosting?
Not currently. Workspace owners can invite members where their plan allows it, but enterprise identity controls and private-cloud deployments are not available.
Updates
Wavey Security Center
Publishing checks, on-demand AI code reviews and optional recurring Business scans are available in Settings → Security Center.
Provider and location details
This page explains which service providers Wavey uses and where customer-specific region controls are not yet available.