Trust
Trust & compliance
How WAVE protects data, who we build on, and where to find every legal commitment.
- 01Data Processing AddendumGDPR/CCPA data-processing terms for customers.2026-09-01
- 02Business Associate AgreementHIPAA BAA terms for healthcare customers.2026-09-01
- 03Service Level AgreementUptime commitments by tier (99.5% / 99.9% / 99.95%).2026-09-05
- 04EU AI Act ComplianceArticle 26 record-keeping and AI transparency posture.2026-09-01
- 05Data ResidencyWhere WAVE stores and processes data.2026-09-01
- 06Privacy PolicyHow WAVE collects, uses, and protects personal data.2026-09-06
All 11 documents: Legal index
Our posture
| Area | What we do | Evidence |
|---|---|---|
| Privacy by design | GDPR & CCPA aligned, with a signed DPA available for customers. Consent-first analytics; Do-Not-Track respected. | DPA |
| Healthcare-ready | HIPAA-ready under a signed Business Associate Agreement (BAA). | BAA |
| AI transparency | EU AI Act Article 26 record-keeping, with immutable audit records and multi-year retention. | EU AI Act |
| Messaging compliance | A2P 10DLC compliant messaging across the platform. | SMS / A2P |
| Machine-readable posture | The security contact and disclosure policy ship as an RFC 9116 security.txt at trust.wave.online. A person or an agent reads the posture with one request: no PDF, no sales call. | security.txt |
| Encryption | TLS in transit and at rest; secrets centrally managed, never committed to source. | |
| Gateway-enforced access | Authentication, scope, entitlement, and metering enforced at one edge gateway, across every product and agent. |
Subprocessors
Infrastructure & data
CloudflareEdge compute, CDN, storage, DNS, and AI inference (speech-to-text, embeddings) — SOC 2 Type II
SupabaseApplication database & authentication — SOC 2 Type II
PostHogProduct analytics — pseudonymous usage events, never message content
UpstashRedis cache & message queue
Payments
StripePayments, subscriptions & metered billing — PCI DSS / SOC 2 Type II
BridgeStablecoin on/off-ramp & KYB verification
PrivyEmbedded & smart-wallet provisioning and key management
TempoStablecoin settlement (pathUSD)
Coinbase CDPWallet infrastructure & gas sponsorship
MetronomeUsage-based billing metering
Communications
TwilioInbound & outbound telephony and A2P messaging
ResendTransactional & notification email
Media & video
ZoomMeeting recording import, with your authorization
AI inference
DeepgramSpeech-to-text transcription
ElevenLabsText-to-speech voice synthesis
GroqLow-latency language-model inference
RunPodGPU compute for AI inference and media transcoding
WAVE documents where data is stored and processed. See the Data Residency policy for specifics by region. Data Residency