Security

We handle your Confluence content with care, because we know how sensitive internal documentation can be. Here’s exactly what we do and what we don’t yet do, so you can make an informed call.

What we do

• Hosting & jurisdiction. WikiFix is operated by Totem Dev, a company incorporated in Moldova — outside the EU and outside the United States. Totem Dev has no US corporate parent, subsidiary, or office, so the company itself is not subject to the US CLOUD Act or to US legal process. All customer data is processed in AWS Frankfurt (eu-central-1), contracted via AWS EMEA SARL in Luxembourg, including LLM prompts and completions. Your data physically never leaves the EU.
• Encryption. All Confluence content is encrypted in transit (TLS 1.3) and at rest (AES-256 via AWS KMS).
• Data minimization. We keep a derived index (chunk embeddings) and the short excerpts behind each finding — not a full copy of your wiki. We write nothing back without your explicit approval, and any fix reverts in one click.
• Tenant isolation. Every database query is auto-filtered by PostgreSQL row-level security. One customer’s data is never reachable from another’s queries — the database refuses to return it even if the application asks.
• Minimum-necessary scopes. OAuth permissions are scoped to read the spaces you tell us to scan and write back only to pages you choose to fix.
• Subprocessors. Every subprocessor is configured to its EU region: AWS EMEA SARL (storage, compute, LLM inference — Frankfurt), Stripe Payments Europe (Dublin), PostHog Cloud EU (analytics — Frankfurt), Sentry EU (error tracking — Frankfurt). Anthropic PBC is listed for transparency as the model licensor, but per AWS Bedrock’s contractual terms, Anthropic has no access to your prompts or completions — only AWS does. Full subprocessor list available on request at security@wikifix.ai.
• Bug bounty. We participate in the Atlassian Marketplace Bug Bounty program. Found something? security@wikifix.ai. We acknowledge within 24 business hours.
• CSA STAR Level 1 self-assessment. Our CAIQ v4 is filed publicly at the Cloud Security Alliance STAR Registry — direct link. Industry-standard self-assessment, independently verifiable. Maps to most of the same controls SOC 2 covers.
• Standard DPA, GDPR-ready. Available on request — no negotiation needed for most customers: security@wikifix.ai.
• No training on your data. We use AI inference via AWS Bedrock (Anthropic’s Claude model) configured so your content is never used to train, retrain, or improve generic AI models. Your knowledge stays yours.

What we don’t have yet

SOC 2 attestation. Not today. The audit alone costs $15,000+ and we won’t burn pre-revenue cash on it — that’s not where it serves our customers best. We’ll engage an auditor once paying-customer revenue justifies the spend, likely 6–12 months after launch.

If your procurement requires SOC 2 attestation today, we’re not the right fit yet. If our STAR Level 1 self-assessment + DPA + the rest of what’s on this page covers your review, we’d love to talk. We answer custom security questionnaires within 3 business days.

US data residency. We don’t offer it. US customers’ data is hosted in AWS Frankfurt alongside everyone else’s — a deliberate choice for a single jurisdictional surface and clean GDPR posture. The latency tax is ~100ms round-trip vs a US-hosted alternative, which is rounding error against our scan workload (asynchronous). If your procurement requires US-only data residency, we’re not the right fit today.

EU-sovereign AI. Our LLM inference runs on Anthropic’s Claude model via AWS Bedrock in Frankfurt. AWS and Anthropic are US-incorporated companies; per AWS Bedrock’s contractual terms, Anthropic-the-company has no access to your prompts or completions, but the underlying model is built by a US company. If your procurement requires an EU-incorporated model provider (Mistral, Aleph Alpha, etc.), we’re not the right fit yet.

EU-sovereign hosting. Our hosting subprocessor is AWS, contracted via AWS EMEA SARL in Luxembourg. While Totem Dev itself is not subject to the US CLOUD Act, AWS is a subsidiary of a US-incorporated company and is therefore reachable by US legal process under the Act. AWS’s published commitments include challenging government data-access requests and notifying customers when legally permitted, but the legal reach exists. If strict, full-stack CLOUD-Act-free hosting on an EU-incorporated provider (OVHcloud, Scaleway, Hetzner, IONOS) is a procurement requirement, we’re not the right fit today. Customer signal moves the roadmap — tell us at security@wikifix.ai if this is a deal-driver.

When we will have it

When the math works. We’re tracking the “engage auditor” decision against revenue milestones — once paying-customer revenue justifies the $15k+ audit spend, we engage Vanta and start the Type 1 path. If SOC 2 is a deal-blocker for you, email security@wikifix.ai and tell us — we move our roadmap on customer signal, and your specific need is signal.

Reporting security issues

security@wikifix.ai. We acknowledge within 24 business hours. We don’t have a paid bug-bounty program yet (see “what we don’t have yet” above), but we credit researchers in our release notes and respond seriously.

Contact

For DPA signing, custom questionnaires, or specific security questions: security@wikifix.ai.