Security and trust

Last updated: [DATE] · Security contact: [security@…] · See also sub-processors and the DPA

How your data is separated

Every workspace's data is isolated in the database itself: row-level security checks every read and write against who you are and what you were given, and a hostile test battery that attempts cross-tenant access runs on every change to the database.

In transit and at rest

All traffic is encrypted with TLS. [State encryption at rest for the database, backups and object storage, and key management.]

Accounts and access

• Sign-in by email and password, with single sign-on (SAML) for organisations.
• Roles per workspace (owner, editor, commenter, viewer) and admin roles that grant no content access.
• An audit log of membership, sharing and settings changes for owners and auditors.
• Payment details never reach WeDraw: Stripe holds them.

Your data, your control

Anyone can download everything WeDraw holds about them, and delete their account. Owners can keep AI off a workspace or a single board.

Operations

[Backups and their retention, monitoring, incident response and the breach-notification commitment, uptime commitment (Enterprise SLA), status page.]

Certifications

[None yet. List SOC 2 / ISO 27001 only once awarded, with the report or certificate available under NDA.]

Reporting a vulnerability

Please write to [security@…] — see SECURITY.md. We acknowledge within [N] working days and will not pursue good-faith research that follows it.