Security & Compliance

TellWang is built for businesses that need to verify their security posture, not just assert it. Every guarantee on this page maps to a control you can audit against the live system.

Isolation

Every Wok is private: its own Postgres container, its own services, on its own private network. Paid plans run on your own private server; Free runs on the shared platform. Cross-tenant traffic is impossible at the network layer. At the API layer, every request that touches a Wok is authorized server-side against the owning team and returns a 404 — not a 403 — on cross-team access, so a foreign Wok's existence is never revealed. A checker on the host re-verifies the isolation rules every fifteen minutes, and a cross-tenant probe can be run against the live fleet on demand. For dedicated or confidential isolation, see Isolation tiers.

Region

The free shared platform runs in AWS Canada (ca-central-1). Private servers for paid plans run on Cherry Servers in US-Chicago; Scale + HA and Enterprise add a second server in LT-Siauliai. If your compliance posture requires a specific region, talk to us before provisioning.

Disaster recovery

Database dumps, storage-file archives, and Wok code archives are written to separate-AZ storage off the Wok host. Continuous WAL archiving keeps the database recoverable to within minutes. On Scale + HA and Enterprise, the second server keeps a live copy of each database and takes over automatically if the first fails. Recovery is exercised against scratch space rather than live data, so restoring is never rehearsed on top of something you depend on. TellWang's own records (organizations, app settings, encrypted keys, chat history) are copied to a second region.

Yours to audit & to take

• Tamper-evident audit log — every state-changing API call writes a row to a hash-chained log; each row's hash includes the previous. A leaked Bearer can write entries but can't silently rewrite history. Customers query their own org's chain via GET /v1/audit-log; TellWang runs GET /v1/audit-log/verify against the same chain to detect any break.
• Open source — the code that runs your Wok is open to read.
• Portable — your data is standard Postgres and exports with pg_dump on any plan, so it's always yours. On every paid plan you can also export the whole Wok as Terraform HCL in one call and redeploy it on another cloud, your own account, or self-hosted. No lock-in.

Encryption & access

• In transit — every public endpoint serves HTTPS (TLS 1.2+); HTTP redirects to HTTPS. Custom domains use Let's Encrypt with on-demand provisioning.
• At rest (secrets) — per-Wok secrets (env vars, JWT secrets, OAuth client secrets, and provider keys) are encrypted with AES-256-GCM envelope encryption. The GET /env endpoint deliberately returns names only, never values — a leaked Bearer can't bulk-exfiltrate every configured secret in one call.
• At rest (data) — Wok data is encrypted at rest on disk.
• Access — checked on every request (no client-side authz). Wang is authorized exactly like any other caller — it can never reach another team's Wok, even if someone tries to trick it into doing so.

Compliance

GDPR / CCPA data export and deletion of your live data are supported; backup copies age out on their retention schedule afterward.

Session replay is not part of aggregate analytics and never turns on silently. An owner/admin must acknowledge its privacy behavior per app. Existing apps default to masked text. Full-fidelity mode is a separate owner choice that records ordinary visible page copy, layout attributes, and web fonts so the page can be reconstructed accurately. Form inputs remain masked in every mode; data-tw-mask protects selected text, data-tw-block excludes a sensitive subtree, canvas stays off, and URL queries are removed again at ingest. Global Privacy Control and automated browsers stop the recorder. Private lifecycle markers measure idle reading time without recording extra page content. Public bootstrap and ingest are rate-limited. Recordings are capped per session, per app, and globally, and deleted after seven days. Replay reads require build access, and recordings are stored privately.

Aggregate audience analytics keeps country/region codes, coarse device class, primary language, bounded source/campaign attribution, privacy-safe clicked-element labels, and explicit conversion outcomes. TellWang validates direct and Cloudflare-proxied client addresses before country and region are derived locally, then the raw visitor IP is discarded. Visitor-country and clicker-country breakdowns count distinct daily cohorts. Daily visitor identifiers rotate at UTC midnight; age and gender are not inferred or stored. Authorized TellWang operators can view those aggregate rollups for every active production Wok, including Woks without a connected domain, along with Wok-scoped Agent Cell build time and tokens. Every cross-customer list and detail read is server-gated and audit-logged; raw event files, raw IP addresses, person profiles, customer-facing app LLM calls, and replay recordings are excluded.