Beta draft — last updated 2026-07-01
Security & data handling
We'd rather tell you plainly what's true today than make broad claims. If you have a specific question this page doesn't answer, contact us directly.
Multi-tenant isolation
Every organization's data — clients, projects, tasks, documents — is isolated using PostgreSQL Row-Level Security (RLS), enforced at the database layer, not just in application code. Every table has RLS enabled, and write operations are scoped to the organization the request belongs to. During our own internal testing, we found and fixed an isolation gap before it reached any customer outside our own team — we mention this because "we test for this and fix what we find" is a more honest signal than implying it's never happened.
Authentication
Sign-in is handled by Supabase Auth. We provide self-serve password reset and in-app password change, tested end-to-end. Email confirmation is required for new accounts, and leaked-password protection (checking new passwords against known-breached password lists) is enabled.
Service-role key protection
Our most privileged database credential (the service-role key, which bypasses row-level security) is used only in trusted, unauthenticated server contexts — never sent to the browser, never used for routine user-facing requests.
Hosting & backups
Our database, authentication and file storage run on managed infrastructure in the London (EU/UK) region, on a plan tier that includes automated backups. We're still confirming the exact backup retention window before we publish a specific number here — we'd rather say "we're checking" than guess.
Who has access
WombatOps is currently operated by a small, founder-led team during an assisted beta. There's no large support organization with broad data access — access is limited to the people directly operating the product.
Incident response
We maintain an internal incident-response process covering severity levels, containment, customer notification and postmortem review. If you've found a security issue, see our vulnerability disclosure page.
Data export & deletion
You can request an export or deletion of your account or organization's data at any time by contacting us. This is currently a manual process — a self-serve tool is planned but not built yet.
Subprocessors
We use a small number of providers to operate WombatOps (database/auth/storage, hosting, transactional email, and an AI provider for one optional feature). See our subprocessors page — some regions are still being confirmed and are marked as pending there rather than guessed.
What we are not (yet)
We are not independently certified to ISO 27001, SOC 2, or any other formal security standard, and we have not commissioned an independent penetration test. We are not claiming GDPR, UK GDPR, NIS2, CRA, or DORA compliance — we're a small beta-stage product working through what's required, and we'd rather be upfront about where we are than overstate it. See our beta limitations for the full list.