Our approach
Organisations trust WavesPath with their members' records, payments and credentials, so security is built into how the platform works rather than added afterwards. This page describes the measures in place today. It is part of our Data Processing Agreement.
How data is protected
- Encryption. Every connection to WavesPath uses HTTPS. Data is stored encrypted at rest by our hosting providers, and secrets such as payment gateway keys are encrypted again before they are stored.
- Card payments. Cards are taken on the payment gateway's own secure pages. Card numbers never reach our servers.
- Separation between organisations. Every record belongs to one organisation, and every request is checked against the organisation it comes from, so one organisation cannot reach another's data.
- Access control. Each organisation chooses what each of its staff can see and do, area by area. Members reach their own area through a personal link that only works on devices they have confirmed.
- Sign-in. Passwords are stored only as secure hashes. Two-factor sign-in with an authenticator app is required for TAPP staff and available to every account.
- Our own access. TAPP staff reach customer data only when they need to, through access limited by area, and important actions are recorded.
- Files. Uploads are checked for type and size and stored under the organisation's own space. Files marked view only are shown through links that expire within an hour.
- Email. Organisations can send from their own verified domain, signed so that receiving servers can confirm it is genuine. Bounces and complaints are recorded and those addresses are no longer written to.
- Protection against abuse. Public forms and sign-in are rate limited, and repeated failed sign-ins lock the account for a time.
- Backups. Our database host keeps continuous backups with point-in-time recovery.
- Your data, your way out. Organisations can export their records at any time.
Subprocessors
We use a small number of established providers to run WavesPath. Each works under a contract that limits it to providing its service to us and protecting the data it handles.
| Category | What it does | Where |
|---|---|---|
| Cloud hosting | Runs the WavesPath application and delivers its pages | United States, with delivery worldwide |
| Managed database | Stores the platform's records | United States |
| File storage | Stores uploaded files, pictures and documents | United States and worldwide delivery |
| Email delivery | Sends the emails organisations and WavesPath send, and reports deliveries and bounces | United States |
| Artificial intelligence | Answers questions in the website assistant, and offers optional writing help in messages | United States |
Payment gateways are chosen and connected by each organisation for its own sales; they are the organisation's providers rather than ours. Customers can ask for the current named list of our subprocessors at hello@wavespath.com, and we give 30 days' notice before a change.
Reporting a security concern
If you believe you have found a security problem in WavesPath, please email hello@wavespath.com with "Security" in the subject and enough detail for us to reproduce it. Please do not access other people's data or disrupt the service while looking. We will reply, keep you informed and credit you if you wish.
Questions about this page?
Write to us at hello@wavespath.com. If you are a member of an organisation that uses WavesPath, that organisation can also help with your own record.