Trust & security
How we look after your store and your shoppers’ data. Only what the system actually does.
Monitoring and uptime
- Every running store is checked every minute. A store that doesn’t respond for three minutes in a row is restarted automatically, and the Waise team is alerted.
- A public status page. System status updates itself from the system, and lists every incident of the last seven days.
Backups
- A full backup every night. Each store’s database, together with its images and files, is kept for 14 days.
- We check that backups restore. After the backup, an automatic drill opens the newest copy and checks that it is complete.
Encryption
- In transit. Every store address, and every domain you connect, is served over HTTPS.
- At rest. Your store’s credentials (payments, mail, advertising) are stored encrypted with AES-256-GCM, and the encryption keys can be rotated.
- Passwords. Stored only as a scrypt hash. A new password is checked against known breaches, without the password itself leaving our server.
Access to your account
- Two-step verification. A code from an authenticator app after your password, with recovery codes. How to turn it on
- Team permissions. Each person on your team gets only the screens they need, and the security log in your admin shows who signed in and what changed.
Where your data lives
- Servers in the EU. The stores and their databases run at Hetzner in Germany.
- The money doesn’t pass through us. Shoppers’ money goes straight to your store’s own payment processor, not through Waise.
- Your data is yours. You can download your products, customers and orders at any time, even when you leave.
Sub-processors
The companies that process personal data on the stores’ behalf, for what and where. It is the same list as in the privacy policy and the Data Processing Addendum.
| Sub-processor | Purpose | Location |
|---|---|---|
| Hetzner | Servers that run the stores and their databases | Germany (EU) |
| Cloudflare | Secure routing of traffic, custom-domain certificates and domain protection | Global network |
| Resend | Sending email (order mail, marketing mail, platform mail) | EU region (eu-west-1) |
| Anthropic | The AI behind Pulse, the setup wizard and the shopper chat; content is not used to train models | United States |
| Twilio | Text messages: verification codes and a store's SMS | United States |
| Stripe | Charging the Waise subscription and keeping the card | United States / Ireland |
| Google Workspace | Waise's own mailboxes (admin@, info@, help@, privacy@): support and business correspondence only | United States / global |
| Sentry (Functional Software) | Error reports from the platform and the stores, only when error reporting is turned on (SENTRY_DSN); a report can hold a page address or a record ID | United States |
| Backup storage provider | Encrypted off-site copies of the databases and files | Per the storage bucket |
| Paddle | Charging the Waise subscription outside Israel, as merchant of record (it handles the card and the sales tax) | United Kingdom / United States |
| Grow (Meshulam) | Charging the Waise subscription for stores in Israel | Israel |
| PayPlus | Charging the Waise subscription for stores in Israel | Israel |
| Cardcom | Charging the Waise subscription for stores in Israel | Israel |
Documents and contact
- Data Processing Addendum (DPA) applies to every store once the terms are accepted, with no separate signature.
- Privacy policy · Terms of use
- Privacy and data requests: privacy@waise.app
- Found a security problem? help@waise.app write to us, and a person will get back to you.