Security & compliance

What we have, and what we do not have yet

Every control on this page was checked against the running system on 1 September 2026. Certification status is stated plainly. If a control is on the roadmap it says roadmap, not “enterprise-grade”.

A glowing shield of light protecting a ring, watch and band

Certifications

Attestation status

SOC 2 Type II

Not yet audited

No audit has been commissioned. If your procurement requires an attestation report, WearLink will not pass that review today.

ISO/IEC 27001

Controls mapped, not yet certified

Controls above are mapped to Annex A families for your review; there is no certificate and we do not claim alignment beyond what is listed.

HIPAA

BAA available on Enterprise

A Business Associate Agreement is available on request on the Enterprise tier. WearLink is not a covered entity and has not been independently assessed.

GDPR / DPDP subject rights

Supported by API

Per-user export and deletion endpoints support access and erasure requests. Consent is collected by the vendor at connection time.

Controls

Controls mapped to ISO/IEC 27001 Annex A

Mapping is for your reviewer’s convenience. It is not a claim of certification or of full coverage of any family.

Access control

ISO/IEC 27001 A.5.15–A.5.18, A.8.2–A.8.5

API keys stored as SHA-256 hashes only
Raw keys are shown once at creation and cannot be recovered.
in place
API key scopes and rotation
Keys carry scopes; rotation issues a new key and retires the old one.
in place
Two-factor authentication for developers (TOTP)
Optional; secrets are Fernet-encrypted at the application layer.
in place
Role-based access within a developer organisation
Team invites with roles; privileged actions are audited.
in place
JWT sessions with revocation
Short-lived access tokens, refresh-token rotation, server-side blacklist.
in place
Tenant isolation on every query
End-users are scoped to the owning developer; cross-tenant reads return 404.
in place

Cryptography

ISO/IEC 27001 A.8.24

TLS 1.2+ for all traffic, HSTS enabled
Let’s Encrypt certificates; HTTP redirects to HTTPS.
in place
Webhook payload signing
Deliveries are signed by Svix; verify the signature before trusting a payload.
in place
Application-layer encryption of provider OAuth tokens
Tokens are held in Postgres on the single-tenant host with database access restricted to the application. Field-level encryption is planned; we will not claim it before it ships.
roadmap

Data handling

ISO/IEC 27001 A.5.34, A.8.10–A.8.12

EXIF metadata (including GPS) stripped from meal photos
Images are re-encoded before storage; orientation is baked in first.
in place
Per-user data export
Full normalised history for one end-user in a single request.
in place
Per-user hard deletion
Removes stored data and revokes provider connections.
in place
Append-only audit log with NDJSON export
Every privileged action; export with one request for questionnaires.
in place
Data-retention schedule per data class
Documented in the privacy policy; automated enforcement is being extended.
partial

Operations

ISO/IEC 27001 A.8.6–A.8.9, A.8.15–A.8.16

Rate limiting on the API and auth endpoints
Per-IP limits at the edge plus per-plan quotas in the application.
in place
Error and exception monitoring
Sentry, with health data scrubbed from events.
in place
Public system status page
Refreshes every 30 seconds from the same health checks we alert on.
in place
Provider status reconciled against the live API
The provider page cannot drift from what the running system reports.
in place
Independent penetration test
Not yet commissioned.
roadmap

Payments

PCI DSS scope

Card data never touches WearLink
Razorpay (PCI DSS Level 1) hosts the checkout; we store only order and payment identifiers.
in place

Hosting

Where the system runs

Application and database

Isolated single-tenant infrastructure with Asia-Pacific (Malaysia) data residency; additional regions on Enterprise. Not a US or EU hyperscaler region.

Export storage

Async user-data exports are written to a self-hosted S3-compatible object store on a separate host, reachable only from the application.

Subprocessors

Svix (webhook delivery), Razorpay (payments), Sentry (error monitoring), Anthropic (meal-photo recognition), Google Workspace (transactional email). Listed in full in the privacy policy.

FAQ

Frequently asked questions

Is WearLink SOC 2 or ISO 27001 certified?

No. Neither audit has been run. The security page maps the controls that exist to ISO 27001 Annex A families so a reviewer can assess them on facts, and lists what is on the roadmap. We will not describe a control as in place before it ships.

Where is data hosted?

On isolated single-tenant infrastructure with Asia-Pacific (Malaysia) data residency, operated with our infrastructure partner; additional regions are available on Enterprise. Async export files are stored on a separate self-hosted object store. Region options can be discussed for Enterprise deployments.

How are API keys protected?

Keys are stored only as SHA-256 hashes. The raw key is shown once at creation, can be scoped, and can be rotated at any time from the dashboard or API.

Are provider OAuth tokens encrypted?

Not at the field level today. They are held in Postgres on the single-tenant host with database access restricted to the application, behind TLS and the controls listed above. Application-layer encryption of provider tokens is on the roadmap and is stated as such rather than implied.

How do I report a vulnerability?

Email hello@wearlink.io or use the address in /.well-known/security.txt. We acknowledge reports within two business days.

Send us your security questionnaire

We answer on facts, including the answers you will not like. Reply within two business days.

Contact security Read the privacy policy