Security
Last updated 28 October 2026
Teams put their strategy into Wayframer, so we treat its security as part of the product. This page describes how we protect your data and how to tell us about a vulnerability.
Report a vulnerability
If you believe you have found a security issue, email security@wayframer.com and keep the details private until we have fixed it. Please include:
what the issue is and what it lets someone do
the steps to reproduce it, or a proof of concept
the address, endpoint or part of the app affected
how we can reach you
We aim to acknowledge your report within two business days and give you a first assessment within five, and we will keep you informed while we fix it. Once the fix is out, we publish an advisory and credit you, unless you prefer to stay anonymous.
In scope
wayframer.com and the app it serves, including its API
sign-in, permissions and session handling
the separation between one organisation's data and another's
Huxley and the AI features, and how they handle data
our setup of the services we connect to, such as Stripe, email and file storage
Out of scope
vulnerabilities in the services we depend on, which should be reported to those services
denial-of-service attacks
social engineering of our team
physical attacks on our providers' infrastructure
issues that need physical access to someone's device
reports from automated scanners without a working proof of concept
Safe harbour
We will not take legal action against anyone who, in good faith:
avoids privacy violations, data destruction and service disruption
only accesses accounts they own or have permission to test
gives us reasonable time to fix an issue before disclosing it
takes no more data than is needed to show the issue
How we protect your data
Accounts and sign-in
You sign in with your email address and a password. Passwords are stored as bcrypt hashes, which cannot be turned back into the password.
Passwords must have at least 8 characters, with upper and lower case letters and numbers, and we refuse passwords that appear in known data breaches.
After five failed attempts, signing in to that account from that address is paused for a short time.
Session cookies are encrypted, sent only over secure connections and kept out of reach of page scripts, and a new session starts each time you sign in.
Your data
Every connection to Wayframer is encrypted with HTTPS, and browsers are told to use nothing else.
Each organisation's data is kept apart from every other organisation's. The app limits what it reads and writes to the organisation the data belongs to, and an automated check on every code change looks for queries that skip that limit.
API keys and other secrets are encrypted in our database.
Our AI usage logs leave out the text of your requests, and our error reports are set up to leave out personal data.
Work you delete can be restored for 30 days, and is then removed permanently.
How we build and run Wayframer
Security headers limit what can load on our pages and stop other sites from framing them.
Forms and requests are protected against cross-site request forgery, and sign-in and public forms such as the newsletter are rate-limited.
Our dependencies are checked for known vulnerabilities on every change and every week, and every code change is scanned for common security mistakes.
Changes made in our admin console are recorded in an activity log, with who made them and what changed.
For how we handle personal data, see our Privacy Policy. The providers that process data for us are listed on our Sub-processors page.