Security

It runs quietly
and holds up to real scrutiny.

Winglo runs continuously with access to your business data. That access is earned through architecture built for isolation, encryption, and governance, not bolted on after the fact.

Infrastructure principles
01 · Workspace isolation

Every workspace is fully isolated.

Winglo enforces workspace boundaries at every layer: database, application, and inference. Nothing crosses between workspaces, ever.

Runtime isolation log
08:42:17INFOtenant:acme-corpisolated
08:42:17INFOdb.partition:wsp_4a2bbound
08:42:18INFOinference.ctxscoped
08:42:18OKcross-workspace accessDENIED
08:42:19INFOagent.run:mkt_weeklylaunched
08:42:19INFOmemory.readworkspace-scoped
02 · Encryption

Always encrypted.

Not configurable because it is not optional.

at-restAES-256
in-transitTLS 1.3
keysCustomer-managed†
† Enterprise plans
03 · Regional residency

Only your region.

All customer data is hosted in the EU. No data leaves the EU without explicit instruction.

EU — Irelandlive
US — Virginiaroadmap
04 · Audit trail

Full provenance.

Every agent action logged: input, output, model, timestamp, workflow.

Exportable via API
Tamper-evident storage
Workspace-level audit view
05 · Access control

Granular and revocable.

RBAC. SSO on Enterprise. Revoke any agent in one action.

RBACSSOMFAToken scopingInstant revoke
AI governance

Your data doesn't train anything.

Winglo works with frontier model providers under strict no-training agreements. Every agent action is logged with full provenance: auditable, exportable, and revocable at the workspace level.

  • Your data never trains a model, contractually enforced with every model provider Winglo works with.
  • Winglo records every agent action: input, output, model identifier, timestamp, and the workflow responsible.
  • Workspaces can revoke any agent's access in a single action. In-flight work halts immediately.
  • PII redaction is available for regulated workspace configurations.
  • You can export, archive, or fully erase your workspace and all derived data at any time.
Compliance & reliability

We built compliance
in from day one.

We publish our compliance posture honestly: what's live, what's underway, and what's still on the roadmap.

Encryption & isolation

Live

AES-256 at rest, TLS 1.3 in transit, per-tenant isolation at every stack layer. Live since day one.

Audit logs

Live

Every agent action logged with full provenance. Available in the workspace and exportable via API.

GDPR alignment

Live

EU residency option, DPA available, data subject rights workflows built into the workspace.

SOC 2 Type II

Roadmap

Planned. Formal audit process not yet initiated. Controls and evidence collection will begin ahead of GA.

HIPAA

Roadmap

Not currently supported. BAA capability and HIPAA-compliant infrastructure are on the product roadmap.

Penetration testing

Roadmap

Planned third-party pen test prior to general availability. Reports available under NDA on completion.

Security documentation

Need the security docs?

We share architecture overviews, security documentation, and DPAs under NDA. Enterprise teams get a named security contact.

Get our architecture overview, security docs, and DPA, all under NDA.