Trust · Agentic Revenue Operating System

Security built for procurement review.

Enterprise buyers need tenancy isolation, provenance, and governed agents — not a black-box outbound bot. Here is how Wavly is designed to be defended in a security questionnaire.

Start freeDPA template

RLS · HMAC webhooks · audit · governance tiers · DPA

Control pillars

01Tenancy isolation (RLS)Every Postgres table that holds customer workspace data is protected by Supabase Row-Level Security. A signed-in user can only read or write rows their JWT authorizes. Isolation is enforced at the database — not only in application middleware.
02Revenue Graph provenanceAccounts, deals, product events, and outcomes live on one Revenue Graph. Agent recommendations cite sources — CRM truth, first-party signals, Memory patterns — so operators and auditors see why Scout elevated or Closer drafted.
03Governed autonomyScout · Closer · Keeper · Grower draft and queue work. High-risk outbound and mutations require human approval tiers. Autopilot without audit is not the product — governance is a first-class control plane.
04HMAC-signed webhooksConversion ingest accepts X-Wavly-Signature (HMAC-SHA256). When a signing secret is set, every payload is verified in constant time before we touch the database. Idempotency keys de-duplicate replays.
05Immutable security auditIngest attempts, signature mismatches, rate-limit denials, and governance decisions are logged with IP, latency, and safe excerpts. Approval actions attribute to user_id for enterprise review.
06AI workload isolationModel API keys stay server-side. Prompts are workspace-scoped. Signal text is sanitized against prompt injection. Enrichment PII is not logged in plaintext. Service-role paths for AI jobs are isolated from browser sessions.

Data classes

What lands on the Graph — and how it is handled.

ClassHandling
Workspace & GraphAccounts, opportunities, product events, agent handoffs — scoped by workspace_id + RLS.
CRM / product OAuthTokens encrypted at rest; revocable from Settings. Sync runs under your credentials.
Payment instrumentsStripe / Razorpay only — Wavly never stores card numbers.
Enrichment / contact PIIBudgeted enrichment; review queues before outbound. Not a contact-list product.
AI drafts & MemoryDrafts and attributed outcomes stay in-tenant. Provider APIs process on demand; not used to train their foundation models under our contracts.

Control catalog

01

Authentication

  • Supabase Auth for identity sessions
  • Workspace membership gates every Graph query
  • SSO / SAML on Scale roadmap for enterprise IdP
  • API keys rotatable without downtime

02

Transport & host

  • TLS for all public endpoints
  • App on Vercel; data on managed Supabase Postgres
  • Point-in-time backups via platform provider
  • Secret rotation playbook for operators

03

Agent control plane

  • Autonomy levels: approve-all → draft-for-review → auto-qualified
  • Outbound risk behind approval queue by default
  • Cross-agent coordination requests typed and auditable
  • Customer Revenue DNA™ scoring shows match rationale

04

Operational security

  • Rate limits and anomaly signals on ingest
  • Queue isolation per tenant for async jobs
  • Security event APIs for workspace diagnostics
  • Questionnaire turnaround: 2 business days for Scale

Subprocessors (illustrative)

Core infrastructure and billing processors. Full list ships with the DPA package. CRM / product connectors you authorize (e.g. HubSpot, Salesforce, Zoho, Slack, PostHog) sync under your OAuth — they are your systems, not Wavly marketing partners.

StripeGlobal card billing
RazorpayIndia UPI / card billing
HubSpotOptional CRM Graph sync (customer-authorized)
SalesforceOptional CRM Graph sync (customer-authorized)
Zoho CRMOptional CRM Graph sync (customer-authorized)
SlackOptional operator alerts (customer-authorized)
SupabaseAuth + Postgres + RLS
VercelApplication hosting
OpenAIModel API for drafts / analysis (no foundation training on your data)
ResendTransactional email

Compliance posture

Honest status — we do not claim certifications we have not earned.

StandardStatusNotes
GDPR / EEALivePrivacy Policy + DPA template; data-subject requests via privacy@
DPDP Act (India)LivePolicy aligned; rights requests honored through privacy@
DPA (enterprise)AvailableSelf-serve template + countersign request at /security/dpa
Data residencyDisclosedUS primary by default; dedicated EU is infra/sales-led
SOC 2 Type IIRoadmapTargeted for Scale procurement — ask hello@ for timeline
HIPAAOut of scopeWavly is not a covered entity / PHI processor

Security FAQ

Where does customer and CRM data live?

In your workspace on the Revenue Graph — scoped by tenant RLS. Connected CRM and product integrations sync under your credentials. We do not sell or broker your revenue data.

What is the data residency?

Primary Graph/Auth data for the default Wavly deployment is in the United States. Dedicated EU residency is sales-led infrastructure (separate EU Supabase project) — not a Settings toggle. Region disclosure and DPA: hello@thewavly.com or /security/dpa.

Do agents send without approval?

No for high-risk outbound. Approval tiers keep humans in the loop. Autopilot without governance is not the product.

Can you sign a DPA / answer a security questionnaire?

Yes. Download the DPA template or request a countersigned copy at /security/dpa. For questionnaires, email hello@ — we turn Scale reviews around within 2 business days.

Is the conversion webhook authenticated?

Optional but recommended. Set a webhook signing secret; payloads carry X-Wavly-Signature HMAC-SHA256 verified against the raw body in constant time before database writes.

Procurement packet: DPA · Privacy · Talk to Closer · hello@thewavly.com

Next

Ready for the questionnaire?

Download the DPA, or talk to Closer — governed intake for Scale security review.

Start freeDPA template