Beta — last updated 2026-08-31
Security & data handling
We'd rather tell you plainly what's true today than make broad claims. If you have a specific question this page doesn't answer, contact us directly.
Multi-tenant isolation
Every organization's data — clients, projects, tasks, documents — is isolated using PostgreSQL Row-Level Security (RLS), enforced at the database layer, not just in application code. Every table has RLS enabled, and write operations are scoped to the organization the request belongs to. During our own internal testing, we found and fixed an isolation gap before it reached any customer outside our own team; a dedicated row-level-security regression suite now runs before every schema change and every new customer onboarding.
Authentication
Sign-in is handled by Supabase Auth. We provide self-serve password reset and in-app password change, tested end-to-end. Email confirmation is required for new accounts, and leaked-password protection (checking new passwords against known-breached password lists) is enabled.
Service-role key protection
Our most privileged database credential (the service-role key, which bypasses row-level security) lives only in server-side code — never sent to the browser, never used for routine user-facing requests.
Hosting & backups
Our database, authentication and file storage run on managed infrastructure in the London (EU/UK) region, with daily automated backups retained for 7 days.
Who has access
WombatOps is currently operated by a small, founder-led team during an assisted beta. There's no large support organization with broad data access — access is limited to the people directly operating the product.
Incident response
We maintain an internal incident-response process covering severity levels, containment, customer notification and postmortem review. If you've found a security issue, see our vulnerability disclosure page.
Data export & deletion
You can request an export or deletion of your account or organization's data at any time by contacting us. This is currently a manual process — a self-serve tool is planned but not built yet.
Subprocessors
We use a small number of providers to operate WombatOps (database/auth/storage, hosting, transactional email, and an AI provider for one optional feature). See our subprocessors page — some regions are still being confirmed and are marked as pending there.
What we are not (yet)
We are not independently certified to ISO 27001, SOC 2, or any other formal security standard, and we have not commissioned an independent penetration test. We are not claiming GDPR, UK GDPR, NIS2, CRA, or DORA compliance — we're a small beta-stage product working through what's required. See our beta limitations for the full list.