Waymaker
Waymaker One

Data Security

Learn about Data Security in WaymakerOS.

SecurityData Protection

How Waymaker protects your data — encryption, isolation, access controls, and infrastructure security.

Data isolation

Every organisation's data is fully isolated. Your data is never mixed with or accessible by other organisations.

Access rules

Waymaker enforces data isolation at the database level. Every query is automatically scoped to your organisation — it's not application logic that can be bypassed, it's enforced by the database itself.

Organisation boundaries

  • Each organisation has a unique identifier
  • All data rows include an organisation reference
  • Access rules filter every query by organisation
  • Even database administrators cannot accidentally cross boundaries

Encryption

In transit

All data transmitted between your browser and Waymaker is encrypted with TLS 1.3. This includes:

  • API requests and responses
  • File uploads and downloads
  • Real-time collaboration data
  • Authentication tokens

At rest

Data stored in the database and file storage is encrypted at rest using AES-256 encryption.

Authentication security

Waymaker uses enterprise-grade authentication:

  • Password hashing — passwords are hashed with bcrypt, never stored in plain text
  • Session tokens — JWT-based tokens with automatic rotation
  • Multi-factor authentication — TOTP-based MFA support
  • Rate limiting — protection against brute-force attacks
  • CSRF protection — cross-site request forgery prevention

Infrastructure

Hosting

  • Application — deployed globally across 330+ edge locations
  • Database — encrypted data tables with automated backups
  • File storage — Encrypted object storage with global CDN
  • Edge functions — Serverless compute at the edge

Backups

Database backups run automatically on a regular schedule. In the event of data loss, we can restore to a recent point in time.

Access controls

Role-based permissions

Four organisation roles (Account Owner, Org Admin, Team Manager, User) control access at every level. See Account Management for role details.

API key security

API keys are generated with scoped permissions and can be revoked at any time. Keys are displayed once at creation and cannot be retrieved later — if lost, generate a new key.

Data deletion

When you delete your organisation:

  • All data is retained for 30 days (recovery window)
  • After 30 days, all data is permanently and irreversibly deleted
  • This includes: database records, uploaded files, email data, API logs

Individual data deletion (specific documents, tasks, etc.) is immediate — deleted items are removed from active views and permanently deleted during the next cleanup cycle.

Compliance

Waymaker is designed with data protection principles in mind:

  • Data minimisation — we only collect data necessary for the service
  • Purpose limitation — your data is used only to provide the service
  • Access controls — least-privilege access for all team roles
  • Audit trail — activity tracking across key operations

Next steps