Trust center
High-level view of how we protect tenant data, manage access, and keep the platform available. For questionnaires or a signed DPA, email security@wellboregenius.com.
Every user-data table enforces Postgres row-level security on team_id through a single is_team_member() helper.
Protected server functions require the request bearer to re-validate against the auth server; RLS still applies inside the call.
Per-team SDK keys are SHA-256 hashed, verified server-side only, revocable instantly, and carry a last-used timestamp.
Enterprise plans connect Okta, Azure AD / Entra ID, Google Workspace, OneLogin, JumpCloud, or any SAML 2.0 IdP.
All traffic is HTTPS with HSTS; managed Postgres and object storage are encrypted at rest by the platform provider.
Sign-in attempts, AI endpoint access, rate-limit events, and failed authorization are recorded and reviewable by team admins, with CSV export.
Every shipped package is re-checked weekly against public advisory databases and severity-ranked, with PDF/CSV export.
Kernel changes ship with focused drift-guard tests; breaking a benchmark fails the build before it reaches production.
The third parties that can process workspace data are listed publicly, with what each one is used for.
Security reports are routed to security@wellboregenius.com with a 1-business-day acknowledgement target. Formal incident-response documentation is being finalized.
Application traffic is served from a global edge network; tenant data lives in a managed Postgres cluster with automated backups.
Every physics module carries a published proof level, error band, basin coverage, validity envelope, and failure modes; promotion is gated by automated criteria.
SOC 2 Type II is in progress. Contact security@wellboregenius.com for the current stage and timeline.
Need more detail?
For questionnaires, architecture reviews, or a signed DPA/BAA, email us with your timeline and we will route to the right person within 1 business day.