Data handling
We collect the minimum data an engagement needs and we keep it only as long as the engagement requires. Client data lives in systems the client owns or in environments provisioned for the client alone. We do not pool client data, and we do not use client data to train or fine-tune models.
Access to client systems is granted per person, per engagement, and is removed at handover. Every engagement records who had access to what, and that record is part of the handover document.
Security practices
These are the standards we hold ourselves to on the systems we build and operate:
- Encryption in transit and at rest.
- Role-based access control and audit logging in the first release, rather than a later hardening pass.
- Secrets held in managed secret stores, not in source code.
- Dependency and vulnerability scanning in the build pipeline.
- A written incident process: we tell you what happened, what we did, and what changes, in that order.
Where an existing system we inherit falls short of these, we say so during discovery and price the work to close the gap.
Compliance posture
Wande Technology Company is a Texas C corporation. We are not yet SOC 2 certified. We are building our controls against the SOC 2 Trust Services Criteria and intend to pursue a Type I report once client demand justifies the audit cost. If your procurement process requires a specific attestation, tell us early and we will say plainly whether we can meet it.
Where an engagement involves regulated data (health information, financial records, personal data under state or international privacy law), we design to the applicable rules and will sign the agreements those rules require, such as a business associate agreement or a data processing agreement.
Responsible AI
We build AI systems to a standard: a defined scope, access to tools and data scoped to the job, logging of what the system did and the inputs behind it, and a defined point where a person reviews the outcome. We evaluate against real historical cases before anything reaches live work, and we report measured accuracy rather than impressions. We will tell you when a task is a poor fit for AI.
Questions
Security questions and questionnaires go to hello@wande.tech. We answer within five business days.