Security
Last updated: 24 September 2026
The diagnostic may use confidential financial and operational material. This page explains how material is protected from receipt through analysis, report delivery and deletion.
Material is handled under an NDA, transferred through an agreed secure channel, stored privately with restricted access and analysed server-side only for the commissioned diagnostic.
1. Access and isolation
- Access is limited to authorised people who need the material to deliver or secure the engagement.
- When the secure portal is used, customer pages require authentication and email verification; anonymous access is disabled.
- Files are held in private storage without a public address. Temporary signed links are short-lived and created only when required for processing.
- Database and storage policies isolate records and files by customer and authorised user; privileged credentials remain server-side.
- The order agreement and NDA define confidentiality obligations before material is requested.
2. Processing happens on the server
- Document extraction, analysis and report generation run in protected server-side functions. Raw material is not embedded in public pages.
- Only information needed for the diagnostic is sent to contracted AI processing providers. Customer material is not used to train general-purpose models.
- Reports and working results are stored with the same access restrictions as source material and are delivered through the agreed channel.
3. Technology behind the controls
The platform is built on managed, audited cloud infrastructure:
| Layer | Implementation |
|---|---|
| Application and server logic | React with TanStack Start, running on a global edge network that provides automatic HTTPS, DDoS protection, and a web application firewall. |
| Database | Managed PostgreSQL with row-level security policies on every table. |
| File storage | Managed object storage, private bucket, per-user folder policies, short-lived signed download URLs. |
| Authentication | Managed auth service: hashed passwords, JWT sessions, email verification, Google OAuth 2.0, and breached-password screening against Have I Been Pwned. |
| Data in transit | TLS 1.2 or higher on all traffic, with HTTPS enforced. |
| Data at rest | AES-256 disk encryption at the cloud provider level, with encrypted backups. |
| AI processing | Server-side API calls to Google Gemini models; customer data is not used for model training. |
| Monitoring | Automated security scanning of database policies, permissions, and dependency vulnerabilities as part of our development process. |
4. Your control over your data
- The Customer determines what material is supplied and should remove unnecessary personal or special-category data before delivery.
- The Customer may request a copy, return or deletion of supplied material, subject to the contract and statutory retention duties.
- At the end of the agreed retention period, source material and working files are deleted or anonymised; limited encrypted backups may expire later.
5. What we never do
- We never sell or rent your data.
- We never use your business data to train AI models.
- We never share one customer's data with another customer.
- We never expose uploaded documents through a public URL.
- We never store card numbers.
6. Being precise about our claims
- We describe your data as encrypted in transit and at rest. We do not claim end-to-end encryption, because the server must read your documents in order to analyse them.
- Our infrastructure providers hold independent certifications such as ISO 27001 and SOC 2. Wasala Oy itself is not separately certified, and we do not claim otherwise.
- If you have specific requirements — data residency, a data processing agreement, penetration test evidence, or a security questionnaire — contact us and we will answer them directly.
7. Reporting a security issue
If you believe you have found a vulnerability, please contact us through the contact form at wasalaoptima.com with the subject "Security". We investigate all reports and will keep you informed of the outcome. Please do not publicly disclose an issue before we have had a chance to address it.
This document is also available in other languages. In case of any discrepancy, the English version prevails.