Security Overview

1. Encryption and Key Management

We employ a multi-layered encryption system with per-organization, per-context key derivation using HKDF (RFC 5869) with SHA-512, so that each organization and each encryption context is cryptographically isolated.

• AES-256-GCM encryption for sensitive data at rest, with NIST-recommended parameters and authenticated encryption.
• Additional Authenticated Data binds each ciphertext to its organization and context, preventing data from being moved between organizations.
• TLS 1.3 enforced on connections, with HSTS and modern cipher suites.
• Encryption keys managed through a managed key service with rotation and access restricted to authorized personnel using multi-factor authentication.
• Separate encryption contexts for AI integrations, channel tokens, webhook secrets, and authentication tokens, so a compromise in one context does not affect others.

2. Infrastructure Security

Our infrastructure runs on enterprise-grade cloud providers that hold SOC 2 Type II and ISO 27001 certifications. Those certifications belong to the providers; Wexio is not yet independently SOC 2 audited, though this is on our roadmap.

• Primary infrastructure on AWS in the EU (Ireland) region.
• Edge hosting and serverless compute with default region in the EU (Ireland), global CDN, DDoS protection, and a web application firewall.
• Managed database and serverless cache hosted in the EU (Ireland), with automated backups and network-level access controls.
• Network segmentation across production, staging, and development using isolated virtual private clouds with no direct internet access to backend services.
• Continuous monitoring with automated alerting for anomalous activity and security events.

3. Network Security

• Origin controls: Strict CORS enforcement, accepting only trusted Wexio origins in production and staging.
• Transport: TLS 1.2/1.3 on all connections with HSTS; HTTP is redirected to HTTPS.
• Headers: Security headers including Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, and a Content Security Policy on the public website.
• Realtime: Encrypted WebSocket connections authenticated with the same tokens as HTTP requests.

4. Data Isolation and Multi-Tenancy

Organizations share a common platform with strict logical isolation at the database level. Tenant-scoped queries automatically inject the authenticated organization identifier into every database operation, preventing cross-tenant leakage.

• Dedicated option: Pro and Enterprise plans may provision a dedicated database and cache instance for full physical separation, with migration options in either direction.
• Bring-Your-Own-Storage: Bring-Your-Own-Storage allows a Customer to store conversation data in its own database and cache infrastructure; in that mode the Customer is responsible for the storage, backup, and security of that data.
• Deletion cascade: When an organization is deleted, associated data across storage layers is permanently deleted.

5. Authentication and Authorization

We support authentication through OAuth 2.0 identity providers, two-factor authentication, passkeys, and enterprise SSO. No passwords are stored on our systems.

• Providers: OAuth 2.0 providers (Google, Microsoft, GitHub, and others), eliminating password-based credential attacks.
• 2FA: TOTP-based two-factor authentication with recovery codes and lockout on repeated failures.
• Passkeys: Passkeys / WebAuthn for phishing-resistant, hardware- and biometric-backed authentication.
• Sessions: Short-lived access tokens with refresh rotation and device-aware sessions.
• RBAC: Role-based access control with layered authorization guards on every operation.

6. Enterprise SSO (SAML 2.0)

Enterprise organizations can authenticate through their own identity provider using SAML 2.0, with email-domain mapping, optional SSO enforcement, auto-provisioning of new users, and account linking for existing users.

7. Application Security and Injection Prevention

• Validation: Global input validation on all data-transfer objects, rejecting invalid input before it reaches business logic.
• API hardening: Query depth limiting and disabled introspection in production to prevent abuse and information disclosure.
• Injection defense: Escaping of user-supplied patterns to prevent NoSQL injection, and output sanitization to prevent cross-site scripting.
• Webhooks: Cryptographic verification of inbound webhooks from payment, messaging, and channel providers before processing.

8. File Upload and Malware Protection

Uploaded files pass through multiple validation layers and are scanned for malware before becoming accessible, and are stored in organization-scoped storage served through signed URLs.

• Limits: File size and count limits enforced at the application and reverse-proxy layers.
• Type checks: Content-based file-type validation to prevent disguised executables.
• Sanitization: Filename sanitization to prevent path traversal and injection.
• Scanning: Real-time malware scanning with automatic quarantine of infected files.

9. Abuse and Rate-Limit Protection

A multi-layer system guards against inbound and outbound abuse using rate limiting with intelligent escalation, message deduplication, loop and flood detection on automated flows, organization-level escalation, and per-organization and per-channel API limits.

10. Data Retention

We apply configurable data-retention policies that automatically delete messages and associated media after a defined period, enforced by plan tier through a daily automated cleanup process. Organization owners can trigger manual cleanup for immediate erasure needs. Retention supports GDPR storage-limitation (Article 5(1)(e)), erasure (Article 17), data-protection-by-design (Article 25), and security-of-processing (Article 32) obligations.

11. Compliance and Certifications

• GDPR: We process personal data in accordance with the GDPR. For our Customers' end-user data we act as Processor and maintain Article 28 Data Processing Agreements.
• Infrastructure: All primary services are hosted in the EU (Ireland). Our infrastructure providers maintain SOC 2 and ISO 27001 certifications.
• PCI DSS: Payment processing is fully delegated to Stripe, a PCI DSS Level 1 provider; Wexio does not store, process, or transmit cardholder data.
• Vulnerability management: Continuous dependency scanning, with third-party penetration testing and a bug-bounty program planned as we grow.

12. Incident Response

We maintain a formal incident-response plan following NIST SP 800-61, covering identification, containment, eradication, recovery, and post-incident review, with defined severity levels and escalation paths. Where Wexio acts as Processor and becomes aware of a personal-data breach, we will notify affected Customers without undue delay to support their obligations under Article 33 GDPR; where Wexio is Controller, we will notify supervisory authorities and affected individuals as required. Every incident is followed by blameless post-mortem analysis with corrective actions tracked to completion.

13. Security Contact

To report a vulnerability or request security documentation, including our DPA or penetration-test summaries, contact us.