Security and technical and organizational measures
This page summarizes the security practices and technical and organizational measures Wodby maintains for its services.
Purpose and scope
This page summarizes Wodby’s security practices and technical and organizational measures for the services.
This page describes the technical and organizational measures maintained by Wodby to protect customer personal data and related service systems. It is intended to support customer security reviews, procurement diligence, and the security provisions of the Data Processing Agreement and Standard Contractual Clauses.
The measures described here are designed to reflect the nature of Wodby's services, including customer-owned infrastructure and Wodby-managed infrastructure offerings. Exact implementations may vary by product feature, cloud provider, deployment model, and risk profile.
Security governance and risk management
Wodby maintains internal processes for assigning responsibility, reviewing risks, and managing changes to security controls.
- Security responsibilities are assigned to authorized personnel with operational ownership for infrastructure, platform changes, support, and incident response.
- Access to production and support tooling is limited by job role and business need, with changes reviewed and adjusted when roles change.
- New vendors, material architecture changes, and sensitive data flows are reviewed in light of security, privacy, and operational risk.
- Policies, runbooks, and technical controls are updated as services, threats, and legal requirements evolve.
Access control and confidentiality
Administrative access is restricted, authenticated, and logged, and personnel handling customer data are bound by confidentiality obligations.
- Personnel access is granted on a least-privilege and need-to-know basis.
- Administrative access is protected through account authentication controls such as strong passwords, role separation, and additional verification measures where supported.
- Customer environments, support systems, and internal tooling are logically separated according to service function and access role.
- Personnel with access to confidential or customer information are subject to confidentiality duties.
Encryption and key handling
Wodby uses encryption in transit and relies on platform or provider controls for encryption at rest where appropriate.
- Data transmitted over public networks is protected with TLS or comparable encryption protocols where appropriate.
- Encryption at rest is applied where supported by the relevant infrastructure, storage, or managed service component.
- Secrets such as API keys, tokens, and credentials are stored and handled through controlled systems and workflows rather than being broadly exposed to personnel.
- Cryptographic settings are reviewed and updated over time to maintain compatibility with current operational and security requirements.
Change management and secure operations
Wodby uses version-controlled changes, deployment workflows, and operational review processes to reduce implementation risk.
- Code and configuration changes are managed through tracked workflows and version control.
- Platform and infrastructure changes are tested and rolled out through controlled deployment processes appropriate to the service component.
- Critical dependency, platform, and security updates may be applied as part of routine or emergency maintenance.
- Logging, diagnostics, and operational review are used to investigate failures, abuse, and unexpected behavior.
Monitoring, vulnerability management, and testing
Wodby monitors service health and security events and remediates vulnerabilities based on severity and operational context.
- Service monitoring, alerting, and diagnostic tooling are used to identify availability issues, suspicious activity, and operational anomalies.
- Vulnerabilities identified through vendor notices, package updates, customer reports, internal review, or external research are assessed and prioritized based on severity and exposure.
- Security patches, dependency upgrades, and configuration corrections are applied according to risk and operational urgency.
- Wodby may use automated and manual review techniques to assess production hardening, logging coverage, and exposed attack surface.
Availability, backup, and resilience
Wodby uses redundancy, backup processes, and recovery procedures appropriate to the service and deployment model.
- Backup, import, and restore features are implemented according to the purchased service and deployment model.
- Recovery options can depend on whether the customer uses Wodby Cloud, customer-owned infrastructure, cloud-provider-managed services, or customer-configured backup destinations.
- Operational runbooks support incident handling, service restoration, and customer communication during disruptive events.
- Retention windows for backups, logs, and temporary import artifacts are limited by product design, operational need, and legal requirements.
Incident response
Wodby maintains procedures for triage, containment, remediation, and customer notification of qualifying incidents.
- Suspected security incidents are triaged to confirm scope, severity, affected systems, and data exposure.
- Wodby may take urgent containment actions, including credential rotation, temporary access restrictions, infrastructure isolation, or service changes.
- Where a confirmed personal data breach affecting customer personal data occurs, Wodby notifies the relevant customer without undue delay as described in the DPA.
- Post-incident review may lead to updated controls, procedures, and monitoring.
Vendor and subprocessor oversight
Wodby reviews service providers that support delivery of the services and uses contractual protections for subprocessors.
- Vendors are selected based on operational fit and the sensitivity of the functions they perform.
- Wodby imposes contractual obligations on subprocessors and material service providers that are appropriate to the nature of their services and data access.
- Current subprocessors and provider roles are listed on the Subprocessors page.
- Customers may use the DPA objection process if they have a reasonable, documented concern about a new subprocessor.
TOMs reference matrix
This matrix maps common TOMs categories to the controls Wodby currently maintains.
| TOMs category | Examples of current measures |
|---|---|
| Organizational controls | Assigned security responsibilities, vendor review, documented processes, confidentiality duties, and change governance. |
| Identity and access | Least-privilege access, role-based permissions, authenticated admin workflows, and access review on role changes. |
| Network and transmission security | TLS for data in transit where appropriate, controlled endpoints, and provider-level network protections. |
| System integrity and hardening | Version-controlled changes, patching, vulnerability review, and monitored production environments. |
| Logging and monitoring | Operational logs, incident diagnostics, alerting, and anomaly investigation workflows. |
| Resilience and recovery | Backup features, restore procedures, redundancy choices, and incident-response runbooks appropriate to the service. |
| Subprocessor control | Contractual protections, public subprocessor list, and a documented objection-and-remediation process. |
Security requests
Security questionnaires, customer diligence requests, and vulnerability reports can be sent to Wodby.
Security questions, procurement diligence requests, and vulnerability disclosures can be sent to [email protected]. General privacy or data-processing questions can be sent to [email protected].