WingSpanAi Trust Center

1. Security

1.1 Encryption & Key Management

• Data at rest: AES-256, encrypted by Google-managed keys within Firebase.
• Data in transit: All connections use TLS 1.2+.
• Key management: Google Cloud KMS. Customer Managed Keys (BYOK) – Pending.

1.2 Architecture Overview

Network Diagram (Coming Soon)

PNG pending final design review (ETA Q4 2025).

1.3 Policies & SDLC

• Information-Security Policy Bundle
• Secure SDLC templates integrated into pull-request workflow

1.4 Penetration Tests

• Frequency: Annual external OWASP ASVS penetration test (requirement for ISO 27001 continuous improvement)
• Last test: September 2024 – full report available under NDA; high-severity findings remediated within 30 days.
• Next test: September 2025 – redacted executive summary will be published here. (Pending)

2. Privacy

• Privacy Policy
• Data Processing Addendum (DPA)
• Collection Notice (APP 5): Users are informed of data collection via onboarding check-boxes, in-product banners, and contextual tooltips before any personal information is captured.
• Retention & Destruction (APP 11):

  Data Type	Retention Period	Deletion / De-identification Method
  Customer account data	12 months post-contract (default 7-year legal fallback)	Cryptographic erasure + Firestore TTL
  Prospect data	3 years after last engagement	Automated batch delete
  Logs & telemetry	13 months	Rolling window overwrite

• Sub-processors (interim list):

  Vendor	Service	Region
  Google Cloud / Firebase	Hosting, DB, Auth, KMS	US-central1
  Vercel	Edge delivery	US / EU
  Pinecone	Vector DB	US-East-1

  Full registry launches August 2025 with RSS change alerts.

• DSAR Portal: Form-based workflow to request, export, or delete data (Pending – Q3 2025)

Cross-border safeguards: OAIC s 16C contractual clauses & EU SCCs adopted where applicable.

3. Compliance & Certifications

4. Resilience & Uptime

Public status page widget Pending – July 2025.

SOCI Act Notice: While WingSpanAi is not currently classified as critical infrastructure under the SOCI Act, we voluntarily align with its 72-hour breach-reporting expectation (s 30BC) for any material security incident.

5. AI & Data Ethics (RAFT™)

• No customer data is used to train LLMs.
• Vector embeddings are tenant-segregated and encrypted at rest.
• Quarterly model bias & privacy audit (first report: Q3 2025).

RAFT™ safeguards white paper (Pending – October 2025)

6. Roadmap for Pending Items