WingSpanAi Trust Center

1. Security

1.1 Encryption & Key Management

• Account security: MFA enforced for all accounts (clients, partners, employees) via Firebase Auth.
• Data at rest: AES-256, encrypted by Google-managed keys within Firebase.
• Data in transit: All connections use TLS 1.2+.
• Key management: Google Cloud KMS. Customer Managed Keys (BYOK) – Pending.

1.2 Architecture Overview

Network Diagram (Coming Soon)

PNG pending final design review (ETA Q1 2027).

Google Cloud/Firebase ap-southeast-2 hosting; no data leaves Australia.

1.3 Policies & SDLC

• Information-Security Policy Bundle
• Secure SDLC templates integrated into pull-request workflow
• Patch Management: Automated patch management via Google Cloud auto-updates + Firebase managed services
  • Critical security patches: Within 7 days
  • High severity: Within 14 days
  • Standard updates: Monthly maintenance window

1.4 Penetration Tests

• Frequency: Annual external OWASP ASVS penetration test (requirement for ISO 27001 continuous improvement)
• OWASP ZAP Baseline (Feb 5, 2026): 61 PASS, 0 FAIL, 6 WARN (CSP + low/info only) – View Report
• Next test: External OWASP ASVS penetration test, September 2027 – redacted executive summary will be published here. (Pending)

2. Privacy

• Privacy Policy
• Data Processing Addendum (DPA)
• Collection Notice (APP 5): Users are informed of data collection via onboarding check-boxes, in-product banners, and contextual tooltips before any personal information is captured.
• Retention & Destruction (APP 11):

  Data Type	Retention Period	Deletion / De-identification Method
  Customer account data	12 months post-contract (default 7-year legal fallback)	Cryptographic erasure + Firestore TTL
  Prospect data	3 years after last engagement	Automated batch delete
  Third-Party API Cache Data (e.g., PracSuite)	24 hours maximum	Firestore TTL auto-delete; excluded from backups
  Logs & telemetry	13 months	Rolling window overwrite

• Sub-processors:

  For Third-Party API Integration Data (e.g., PracSuite)

  These subprocessors may receive or process data from third-party API integrations:

  Vendor	Service	Region	Data Retention
  Google Cloud / Firebase	Hosting, DB, Auth, KMS	ap-southeast-2 Sydney	24 hours max (TTL)

  Browser Extension Data Recipients

  WingSpanAi uses service providers to authenticate users, operate its browser extensions and generate requested answers. The table below identifies recipients of browser-extension information and the purpose of that processing.

  Recipient	Role	Information received	Purpose
  Google Australia Pty Ltd (Firebase Authentication)	Authentication	Sign-in and authentication information	Verify identity and establish a signed-in session
  Google Australia Pty Ltd (Google Cloud Platform)	Hosting and service operation	Extension requests, relevant account context and operational metadata, as applicable	Operate the service and enforce access controls
  OpenAI OpCo, LLC	Answer generation	Submitted questions and the minimum relevant authorised knowledge	Generate the requested answer

  For questions about browser-extension data recipients or the information they process, contact privacy@wingspanai.com.au

• DSAR Portal: Form-based workflow to request, export, or delete data (Pending – Q2 2027)

Cross-border safeguards: OAIC s 16C contractual clauses & EU SCCs adopted where applicable.

3. Compliance & Certifications

4. Resilience & Uptime

Public status page widget Pending – Q3 2027.

SOCI Act Notice: While WingSpanAi is not currently classified as critical infrastructure under the SOCI Act, we voluntarily align with its 72-hour breach-reporting expectation (s 30BC) for any material security incident.

5. AI & Data Ethics (RAFT™)

• No customer data is used to train LLMs.
• Vector embeddings are tenant-segregated and encrypted at rest.
• Quarterly model bias & privacy audit (first report: Q1 2027).

RAFT™ safeguards white paper (Pending – May 2027)

6. Roadmap for Pending Items