Security

WaveSurge handles the day-to-day creator-marketing operations of consumer brands, and holds brand money on its way to creators. We treat the trust signals — your DMs, your contract terms, your customer lists, and the money — with seriousness commensurate to that role.

Infrastructure

• Hosted on DigitalOcean App Platform (US + APAC regions).
• All traffic over HTTPS with TLS 1.3.
• Database backups encrypted at rest and rotated daily.
• Secrets managed through DO Apps secret store; never checked into source.

Authentication

• Google OAuth as the primary sign-in. No passwords stored on our side.
• Session cookies are httpOnly and SameSite=Strict.
• JWT lifetime is 24h; refresh tokens require interactive re-auth.

Data isolation

• Every read path that touches creator or brand data scopes by `userId` — see the privacy-filter contract in our codebase (kol-cache-visibility.ts).
• Inbound mail classification uses the parent campaign's userId, never global lookup, to prevent cross-tenant leakage.

AI agents

• Every autonomous action has a red-line check. Agents stop and escalate when they detect potential boundary violations.
• Brand voice / red-line config is stored per-campaign, not shared globally.

Payment data

• A creator's bank or wallet details are encrypted at rest. Operators see only the last four characters.
• Full details are revealed only to a WaveSurge administrator, only with a stated reason, and every reveal is written to an audit log.
• Card numbers never reach WaveSurge: card payments are entered on the payment provider's own hosted page.
• Recording that a brand's payment arrived is restricted to WaveSurge staff. That entry is what authorises paying a creator, so the party holding the bank statement is the only party that can make it.
• Money entries are append-only — an error is corrected by a compensating entry, never by editing or deleting one.

What our structure does not do is protect brand funds from WaveSurge's own insolvency: those funds are held in an account in WaveSurge's own name and are not segregated. That is set out in section 9 of the Terms of Service, and it is a commercial fact rather than a security control.

Vulnerability reporting

Found a security issue? Email [email protected]. We commit to acknowledging within 48h and patching critical issues within 7 days.

Compliance roadmap

SOC 2 Type 1 is in scope for Q3 2026. We hold no third-party security certification today, and no audit has been completed.

On data processing: we rely on each sub-processor's own published data-processing terms, listed in our Privacy Policy. WaveSurge does not yet have its own customer-facing data-processing agreement to offer. If your procurement process requires one, email [email protected] and we will tell you honestly where we have got to rather than send you a document that does not exist.