Security

1. Access and isolation

• Every page that shows customer data sits behind authentication. Without a valid session the server returns no data at all.
• Sign-in is email + password or Google. Email addresses must be verified; anonymous sign-up is disabled.
• Uploaded files are stored in a private bucket with no public URL. Access happens only through short-lived, signed links generated by the server on request.
• Each file is written to a folder named after your own account ID, and the storage policy allows read, write, and delete only when that folder matches the signed-in user. Another customer cannot fetch your file even if they guess the exact path.
• Every database table has row-level security enabled, with policies bound to the authenticated user ID. Isolation is enforced by the database itself, not only by application logic.
• Roles live in a separate table and are read through a security-definer function, so a user cannot escalate their own privileges by editing their profile.
• The privileged service key that bypasses row-level security exists only as a server environment variable. It never reaches the browser and is never stored in source code.

2. Processing happens on the server

• Reading, parsing, and analysing documents all run in server-side functions. The browser receives only the finished report — raw documents and raw figures are never sent to the user interface.
• AI calls are made server-side to the model provider. Your data is not used to train models and is not retained by the provider for training purposes.
• Analysis output is stored against your account under the same row-level security rules as the source data.

3. Technology behind the controls

The platform is built on managed, audited cloud infrastructure:

4. Your control over your data

• You can delete the documents you uploaded at any time; deletion removes both the stored file and its metadata.
• You can export or request a copy of the reports generated for your account.
• When your account is closed, your data is deleted or anonymised in line with our Privacy Policy.

5. What we never do

• We never sell or rent your data.
• We never use your business data to train AI models.
• We never share one customer's data with another customer.
• We never expose uploaded documents through a public URL.
• We never store card numbers.

6. Being precise about our claims

• We describe your data as encrypted in transit and at rest. We do not claim end-to-end encryption, because the server must read your documents in order to analyse them.
• Our infrastructure providers hold independent certifications such as ISO 27001 and SOC 2. Wasala Oy itself is not separately certified, and we do not claim otherwise.
• If you have specific requirements — data residency, a data processing agreement, penetration test evidence, or a security questionnaire — contact us and we will answer them directly.

7. Reporting a security issue

If you believe you have found a vulnerability, please contact us through the contact form at wasalaoptima.com with the subject "Security". We investigate all reports and will keep you informed of the outcome. Please do not publicly disclose an issue before we have had a chance to address it.