01
Data residency
Application data lives in PostgreSQL on Amazon Web Services in the Asia-Pacific Mumbai region (ap-south-1). Uploaded media sits in a private S3 bucket in the same region. Primary storage does not leave it.
SecurityHonest about what's in place, and what isn't
Security & data handling
Your clients' data,
handled plainly.
Whizo AI holds your agency's client data, conversations and credentials. This page says plainly what protects them today, and what we don't have yet.
No certification logos we haven't earned.
Agencies hold other people's logins, their customers' messages and their unreleased campaigns. Here is every layer that protects them, and the certifications we don't claim.
01 / Defence in depth
Six layers between the internet and a password.
Follow one request from the open internet down to a client's stored credential. Each layer is something that runs in production today.
- TransportHTTPS with HSTS
- BrowserContent Security Policy
- AccountSign-in protection
- AgencyRole-based access
- WorkspaceClient isolation
- CredentialsEncrypted vault
Request incoming
Scroll to follow a request in.
From the open internet to a client's stored password, here is everything it passes through.
02 / Where your data lives
One region, one set of rules.
02
Infrastructure
The platform runs on AWS in the Mumbai region. The API, the web app and the admin console each run in their own container behind a reverse proxy, and SSH access is restricted to authorized operators.
03
Zero-downtime deploys
Releases go out as a rolling cutover: the new version is health-checked before any traffic moves, and a bad release can be rolled back without extended downtime.
04
Retention & deletion
Your data belongs to you. When an agency account is cancelled, data is kept briefly to allow reactivation, then removed per our retention schedule. Deleting a workspace also removes its stored files.
03 / What we don't claim
No logos we haven't earned.
Whizo AI has not completed formal SOC 2 Type II or ISO 27001 certification audits, and we don't list certifications we haven't earned. If these matter to your procurement process, contact us and we'll give you an honest status and timeline rather than a logo. This page describes real, verifiable controls, not aspirational ones.
Found something?
If you believe you've found a security vulnerability or experienced a data-related incident, report it immediately to support@whizo.ai. We treat responsible disclosure in good faith and prioritise confirmed reports. Platform changes are tracked in our public changelog.
04 / Questions
Questions, answered.
Where is my data stored?
Application data is stored in PostgreSQL on Amazon Web Services in the Asia-Pacific Mumbai region (ap-south-1), and uploaded media in a private S3 bucket in the same region.
Is Whizo AI SOC 2 or ISO 27001 certified?
No. We have not completed formal SOC 2 Type II or ISO 27001 audits and don't list certifications we haven't earned. If they matter to your procurement process, contact us for an honest status and timeline.
How are client passwords in the vault protected?
They are encrypted with AES-256-GCM before they are stored, and the vault only opens with your agency's master password. Access is given per entry, and every reveal and copy is logged.
Who inside my agency can see client data?
Access is controlled by role (owner, manager, member, viewer), scoped per feature and per client workspace, and each client lives in its own isolated workspace. Removing a team member revokes their access.
How do I report a vulnerability?
Email support@whizo.ai. We treat responsible disclosure in good faith and prioritise confirmed reports.
Questions from
your security team?
Email security
We answer with what is actually in place.