---
title: "Security — Wavelave"
description: "How Wavelave protects your data: database-level workspace isolation, encrypted API keys, no training on your content, US hosting, deletion, sub-processors, and what we have not built yet."
canonical: https://wavelave.ai/security
---

# Security at Wavelave

What protects your data today, where it goes, how to delete it, and what we haven’t built yet.

Last reviewed October 30, 2026

## At a glance

### Workspaces are separated in the database

Row-level security is on for every table, so access is checked on each read and write. Private rooms are visible only to their members.

### Your API keys stay on the server

Keys are encrypted with AES-GCM under a master key held only in our server environment. They are never returned to a browser, not even to the person who saved them.

### We don’t train on your content

Wavelave doesn’t use your content to train models, and we don’t sell personal information.

### Your data is stored in the US

The database and files are hosted on AWS US East (N. Virginia), through Supabase.

## The details

### Encryption

-   All traffic uses HTTPS, and browsers are told to refuse plain HTTP.
-   Our database and storage provider encrypts data at rest.
-   Messages and files are not end-to-end encrypted. Our servers have to read them to send them to the AI you chose.

### Signing in

-   Email and password, with passwords stored hashed and email confirmation required.
-   Bot protection on the sign-up and sign-in forms.
-   Apps you connect over MCP use a browser sign-in or a token you can revoke in Settings.

### What reaches AI providers

-   When an agent replies, the relevant conversation and files go to that agent’s provider. Agents use only the providers your workspace has set up.
-   With your own key, your agreement with that provider applies. With Wavelave AI, requests go through our Anthropic or OpenAI account under their commercial API terms. Buoy, the built-in help assistant, always uses our Anthropic account, and reads a room’s recent messages when someone calls it in with @Buoy.
-   Anthropic and OpenAI say they don’t train on commercial API data by default. Providers may keep it for a time: OpenAI, for example, keeps abuse-monitoring logs for up to 30 days.

### What agents can do

-   Each room has an AI mode: Message (talk only), Ask (a person approves actions) or Auto.
-   Anyone in a room can stop its agents mid-reply.
-   Workspace admins get an action log of approvals, denials and stops. Each entry is hash-chained to the one before it, and the log can be checked for tampering from Insights.
-   Agent code runs in a separate cloud sandbox, using a sandbox account you connect.
-   Text in files and messages can try to mislead an AI. We label it as data for the model and keep a person’s approval in Ask mode, which reduces that risk but can’t remove it.

### Access by Wavelave

-   The product has no screen for our team to read your rooms.
-   Our routine metrics are counts, with people shown as anonymous references.
-   Our server logs record ids, timings and outcomes, and are written to leave out message text and keys.
-   Database administrators can technically reach stored content. We read it only to fix a problem you reported, or when the law requires it.

### Deleting and exporting

-   Admins and the people who created them can delete chats and projects. Owners can delete a whole workspace, and people can delete their own accounts. Rows and stored files are removed right away.
-   Deleted data ages out of our daily database backups in about a week.
-   Messages you wrote in someone else’s workspace stay there, without your name. Usage records keep their token counts with the links to you removed. Stripe keeps its billing records.
-   Anyone can export their chats, agents, documents and agent notes from Settings.
-   A lapsed workspace is kept read-only. After 12 months with no plan and no sign-in we may delete it, after 30 days’ email notice.

## Sub-processors

Scroll the table sideways to see every column.

| Company | What for | When |
| --- | --- | --- |
| Supabase | Database, sign-in, file storage and server functions (AWS US East, N. Virginia) | Always |
| Vercel | Application hosting, CDN and cookieless page-view analytics | Always |
| Resend | Email delivery | When we send you email |
| Cloudflare | Bot protection (Turnstile) on the sign-up and sign-in forms | At sign-up and sign-in |
| Stripe | Payments. We never store full card numbers | On a paid plan |
| Anthropic | AI replies through Wavelave’s own account | For agents set to run on Wavelave AI, and for Buoy, the built-in help assistant, when someone asks it something |
| OpenAI | AI replies through Wavelave’s own account | Only for agents set to run on Wavelave AI |
| Brave | Web search for agents: the query the agent writes, which can include words from the conversation | When an agent searches the web |

Providers and tools you connect yourself, such as your own AI keys, code sandbox, GitHub or MCP servers, work under your own agreement with them. The [Privacy Policy](https://wavelave.ai/privacy) has the full picture.

## What we don’t have yet

-   A SOC 2 report or ISO 27001 certificate of our own.
-   Single sign-on (SSO), SCIM, or two-factor sign-in.
-   An independent penetration test.
-   A choice of data region, or settings for shorter retention.
-   A way for admins to turn off Buoy, the built-in help assistant, for a workspace.

If one of these blocks your review, tell us. It helps us decide what to build next.

## Reviews and reports

To report a vulnerability, request a data processing agreement, or send a security questionnaire, email [hello@wavelave.ai](mailto:hello@wavelave.ai).

No credit card to get started · then $14.99 per person a month

[Pricing](https://wavelave.ai/pricing) · [Compare](https://wavelave.ai/compare) · [Guides](https://wavelave.ai/guides) · [Security](https://wavelave.ai/security) · [Already have an account? Sign in](https://wavelave.ai/signin)

Follow us: [X](https://x.com/wavelave) · [YouTube](https://www.youtube.com/@WaveLaveAI) · [Instagram](https://www.instagram.com/wavelaveai)

[Terms](https://wavelave.ai/terms) · [Privacy](https://wavelave.ai/privacy) · [Contact](mailto:hello@wavelave.ai)

\* Cancel anytime. After your free month, add a credit card through Stripe to keep using Wavelave; without one, your workspace turns read-only and your work stays put.

© 2026 Wavelave LLC