1. Overview
Wafix Technologies (“Wafix Technologies,” “we,” “us,” or “our”) maintains administrative, technical, and physical safeguards designed to protect the confidentiality, integrity, and availability of information Processed in connection with our Services. This Security Policy summarizes the measures we apply and supplements the security-related provisions of our Privacy Policy, Data Processing Agreement, and Terms and Conditions.
2. Organizational Measures
2.1 Access Control. Access to Client data, source code, hosting environments, and administrative systems is restricted to personnel and contractors who require such access to perform their role, based on the principle of least privilege.
2.2 Personnel. Wafix Technologies personnel and contractors with access to Client data are subject to confidentiality obligations consistent with Section 14 of the Terms and Conditions, and receive periodic guidance on data handling and security practices appropriate to their role.
2.3 Vendor Management. Wafix Technologies selects Third-Party Service Providers, including hosting, payment processing, and infrastructure vendors, based in part on their security posture and, where applicable, their PCI DSS compliance, SOC 2 reports, or comparable certifications, and enters into data processing or confidentiality agreements with such vendors where appropriate.
3. Technical Measures
3.1 Encryption in Transit. Data transmitted between Clients, end users, and Wafix Technologies-managed systems is encrypted using Transport Layer Security (“TLS”) or a comparable industry-standard protocol.
3.2 Access Authentication. Administrative access to hosting environments, source code repositories, and project management tools is protected by unique credentials, and multi-factor authentication is applied where supported by the underlying platform, particularly for privileged accounts.
3.3 Network Security. Wafix Technologies-managed hosting environments are configured with firewalls, restricted administrative ports, and, where applicable, web application firewalls or comparable protections against common web-based attacks.
3.4 Patching and Updates. Wafix Technologies applies security patches and software updates to infrastructure it directly manages on a commercially reasonable schedule, prioritizing critical vulnerabilities.
3.5 Backups. Where a backup service is included in the applicable Order, backups are maintained consistent with the Wafix Technologies Service Level Agreement, with reasonable measures to protect backup data from unauthorized access.
3.6 Payment Data. Wafix Technologies does not store full payment card numbers, card verification values, or complete bank account credentials on its own systems, relying instead on PCI DSS-compliant Payment Processors as described in the Payment Terms.
4. Physical Security
Where Wafix Technologies or its Sub-processors maintain physical server infrastructure, such infrastructure is generally hosted in third-party data centers that maintain their own physical security controls, including restricted facility access, surveillance, and environmental controls, consistent with the data center operator’s published security standards.
5. Incident Response
5.1 Wafix Technologies maintains an internal process for identifying, assessing, and responding to suspected security incidents affecting its systems or Client data.
5.2 In the event of a confirmed Personal Data Breach affecting Client Personal Data, Wafix Technologies will notify the affected Client without undue delay and in accordance with the notification timeline and process set out in the Data Processing Agreement.
5.3 Wafix Technologies will take reasonable steps to contain, investigate, and remediate confirmed security incidents, and will cooperate with affected Clients regarding any additional notification obligations the Client may have to Data Subjects or regulators.
6. Client Responsibilities
Security is a shared responsibility. Clients are responsible for: (a) safeguarding account credentials and access tokens provided by Wafix Technologies; (b) promptly notifying Wafix Technologies of any suspected unauthorized access to the Client’s account; (c) maintaining appropriate security practices for any systems or accounts not directly managed by Wafix Technologies; and (d) ensuring that any content, plugins, or integrations the Client independently installs on a Deliverable do not introduce security vulnerabilities.
7. Vulnerability Reporting
If you believe you have identified a security vulnerability affecting a Wafix Technologies-managed system, please report it responsibly to the contact information in Section 9, including sufficient detail to allow us to reproduce and assess the issue. Please refrain from accessing, modifying, or exfiltrating data beyond what is necessary to demonstrate the vulnerability, and refrain from public disclosure until Wafix Technologies has had a reasonable opportunity to investigate and remediate the issue.
8. No Guarantee of Absolute Security
No system can be guaranteed to be completely secure, and Wafix Technologies does not warrant that its Services or any Deliverable will be immune from all unauthorized access, security vulnerabilities, or attacks. The security measures described in this policy reflect our current practices and are subject to change as technology, threats, and industry standards evolve.