Security & Compliance

TellWang is built for businesses that need to verify their security posture, not just assert it. Every guarantee on this page maps to a control you can audit against the live system.

Isolation

Every Wok is private — its own Postgres container, its own services, on its own private network. Cross-tenant traffic is impossible at the network layer. At the API layer, every request that touches a Wok is authorized server-side against the owning team and returns a 404 — not a 403 — on cross-team access, so a foreign Wok's existence is never revealed. A checker on the host re-verifies the isolation rules every fifteen minutes, and a cross-tenant probe can be run against the live fleet on demand. Neither is wired into the release path yet. See Isolation tiers for what can be arranged when a shared kernel is not an acceptable boundary.

Region

Today every Wok runs on a single region (AWS ca-central-1, Canada). Multi-region failover and "pick the region your data lives in" do not exist today. If your compliance posture requires a specific region today, talk to the founders before provisioning.

Disaster recovery

Database dumps, storage-file archives, and Wok code archives are written every six hours to separate-AZ storage off the Wok host. Continuous WAL archiving reduces database RPO to minutes. Recovery is exercised against scratch space rather than live data, so restoring is never rehearsed on top of something you depend on. TellWang remains single-region today; a full regional outage is outside the current recovery guarantee.

Yours to audit & to take

• Tamper-evident audit log — every state-changing cp call writes a row to a hash-chained log; each row's hash includes the previous. A leaked Bearer can write entries but can't silently rewrite history. Customers query their own org's chain via GET /v1/audit-log; the operator runs GET /v1/audit-log/verify against the same chain to detect any break.
• Open source — the code that runs your Wok is open to read. "Trust us" plus "here's the source."
• Portable — your data is standard Postgres and exports with pg_dump on any plan, so it's always yours. On Pro and Scale you can also export the whole Wok as Terraform HCL in one call and redeploy it on another cloud, your own account, or self-hosted. No lock-in.

Encryption & access

• In transit — every public endpoint serves HTTPS (TLS 1.2+); HTTP redirects to HTTPS. Custom domains use Let's Encrypt with on-demand provisioning.
• At rest (cp) — per-Wok secrets (env vars, JWT secrets, OAuth client secrets, and retained inactive legacy provider keys) are encrypted under TellWang's AES-256-GCM envelope using a single root KEK. The GET /env endpoint deliberately returns names only, never values — a leaked Bearer can't bulk-exfiltrate every configured secret in one call.
• At rest (wok) — disk-level encryption via the underlying host, rather than a separate envelope key for each Wok.
• Access — checked on every request (no client-side authz). Wang is authorized exactly like any other caller — it can never reach another team's Wok, even if someone tries to trick it into doing so.

Compliance

GDPR / CCPA data export and deletion of your live data are supported today; backup copies age out on their retention schedule afterward.

Session replay is not part of aggregate analytics and never turns on silently. An owner/admin must acknowledge its privacy behavior per app. Existing apps default to masked text. Full-fidelity mode is a separate owner choice that records ordinary visible page copy, layout attributes, and web fonts so the page can be reconstructed accurately. Form inputs remain masked in every mode; data-tw-mask protects selected text, data-tw-block excludes a sensitive subtree, canvas stays off, and URL queries are removed again at ingest. Global Privacy Control and automated browsers stop the recorder. Private lifecycle markers measure idle reading time without recording extra page content. Public bootstrap and ingest are rate-limited. Recordings are capped per session, per app, and globally; the control plane enforces seven-day cleanup in addition to host automation. Replay reads require build access; its storage is private to the control-plane service account.

Aggregate audience analytics keeps country/region codes, coarse device class, primary language, bounded source/campaign attribution, privacy-safe clicked-element labels, and explicit conversion outcomes. Caddy validates direct and Cloudflare-proxied client addresses before country and region are derived locally, then the raw visitor IP is discarded. Visitor-country and clicker-country breakdowns count distinct daily cohorts. Daily visitor identifiers rotate at UTC midnight; age and gender are not inferred or stored. Authorized TellWang platform operators can inspect those aggregate rollups for every active production Wok in the private Live Wok Data Room, including Woks without a connected domain. The same operator-only surface shows Wok-scoped Agent Cell build time and tokens. Every cross-customer list and detail read is server-gated and audit-logged; raw event files, raw IP addresses, person profiles, customer-facing app LLM calls, and replay recordings are excluded.

Where the boundaries are

Worth knowing before you decide, rather than after:

• One region. Your Wok and its backups live in ca-central-1, across separate availability zones, so losing a zone is survivable. Losing the whole region is not: your Wok runs in one place. TellWang's own records — organizations, app settings, encrypted keys, chat history — are copied to a second region, which lets us bring the platform back while your Wok's data is restored from its backups.
• Encryption at rest is disk-level, provided by the underlying host, rather than a separate envelope key per Wok.
• TellWang is not SOC 2 certified. The controls described on this page are real and auditable; the certification is not in place, and we will not imply otherwise.