Tenant isolation and data handling
How WASViking keeps organizations apart, what we encrypt, what we keep, and what never leaves your environment.
WASViking® is a multi-tenant platform. Each customer is an organization, and the data of one organization is never visible to another. This page covers how organizations are kept apart, how data is encrypted, how long it is kept, and how it is backed up.
Organization isolation
- Everything a customer creates or receives (targets, scans, findings, reports, agents, users and API keys) belongs to one organization only.
- Users and API keys only reach the data of their own organization. Data is never shared across customers.
- The audit log shows the activity of your own organization only.
- Any access across organizations is treated as a security defect.
API keys
API keys are issued inside an organization and only grant access to that organization's data, within the scopes you assign to each key. Keys can be rotated, revoked and restricted to IP ranges from the portal.
Partners and customers
The Partner Console (partners.wasviking.com) and the customer portal
use separate accounts. Partner operators are not customer users, and
customer users cannot see partners. What a partner sees of a customer
depends on the operating model
agreed for that customer.
Sentinel agent
- Each agent is bound to one organization by its client certificate.
- An agent only receives work from its own organization and cannot reach the data of any other.
- Content exchanged with the agent, including cookies and internal target responses, is not written to logs.
Encryption
- In transit. TLS 1.2 or later on every public endpoint, and mutual TLS between the Sentinel agent and WASViking.
- At rest. All customer data is encrypted at rest (AES-256). Sensitive fields carry an additional key specific to each organization.
- API keys are stored hashed and are never shown again after creation.
- Credentials for authenticated scanning are encrypted with the organization's key.
What never leaves your environment
- Raw secrets found by the Sentinel agent. Only a hash and a masked preview are sent to WASViking.
- Source files analyzed for SBOM. Only the resulting component inventory (CycloneDX) is submitted.
Retention
| Data | Default retention |
|---|---|
| Scan output | 12 months. Configurable per plan. |
| Findings | Indefinite while the organization is active. |
| Audit log | 24 months. Configurable per plan up to 7 years. |
| MFA codes | 5 minutes. |
| API request logs | 30 days. |
| Posture Share / Bundle access events | Same as audit log. |
| SBOM submissions | Indefinite while the organization is active. |
When an organization closes its account, its data is erased from every active store at the end of a 60-day reversible window; only the records the law requires survive (billing records for 7 years, accepted terms and audit evidence for 5 years, and the record of the closure itself). The procedure, the cancel path and the evidence you receive are described in Account closure and data erasure. Audit log rows that name external parties (auditors who accessed a share, for example) are preserved with identities pseudonymized and the third-party access trail intact.
Backups and recovery
| Commitment | Detail |
|---|---|
| Frequency | Customer data is backed up automatically every day. Point-in-time recovery is available where the data store supports it. |
| Retention | Backups are encrypted and kept for 7 days, then expire. |
| Recovery point objective (RPO) | 24 hours. |
| Recovery time objective (RTO) | 8 hours. |
| Restore testing | Restoration is tested every month and the result is kept as audit evidence. |
| Erased data | Copies of erased data expire with the backup retention and are never restored into production. |
Sub-processors
WASViking uses a short list of sub-processors:
- AWS for compute, storage, network.
- An AI model provider for the AI recommendation surfaces (named in the sub-processor register on the Trust Center).
- Stripe for billing.
- SendGrid for transactional email.
- Cloudflare for edge, WAF, and CDN.
The current list is on the Trust Center
(wasviking.com/trust-center/). We notify customers under DPA
when the sub-processor list changes.
Where to ask deeper questions
- DPA: provided under request from the Trust Center.
- Security questionnaire (CAIQ / SIG): provided under NDA.
- SOC 2 roadmap: posted on the Trust Center.