Security at MyWave: a note from our CISO

From our Chief Information Security Officer, Deepak Veerasamy

I have spent most of my career on your side of this page, reading vendor security statements and deciding whether to put my name to a recommendation. So I will write this the way I would have wanted to read it, focused in five areas:

  1. What changes in your environment when you deploy MyWave

  2. What does not change

  3. What new risk you take on

  4. What you inherit from us

  5. Who stands behind the claims.

If you can answer those five questions, you can write your endorsement. That is what this page is for.

Deepak Veerasamy
Chief Information Security Officer, MyWave

What changes in your environment

MyWave agents run inside your boundary. The runtime is a service you install in your own cloud, your own data centre or your SAP environment, and the agents it runs read and write your business systems using credentials you provision, scope and can revoke.

Our software never asks you to place MyWave-owned credentials in your environment. An agent does what it was designed to do, with the connections and permissions it was given when it was built.

Most customers start with agents that read and recommend, and extend their autonomy as confidence grows. That pace is yours to set.

What does not change in your environment

What does not change is where your data lives. Your business and transactional data stays in your systems. MyWave does not hold it and does not process it.

Where our people need to work in your environment, they do so as guests, on identities you issue and can withdraw, and nothing they see leaves your environment.

Today the only connection from a deployed runtime back to MyWave is a periodic licence check. If we add telemetry, it will carry execution metadata only, and content-level tracing stays off unless you turn it on.

Where your data goes

Agents are designed in the MyWave Innovation Hub, a platform we operate on Google Cloud in the United Kingdom, run day-to-day by a specialist managed hosting provider under contract to us.

The MyWave Innovation Hub is a shared platform. Each organisation works in its own space, separated by authentication and role-based access, and a MyWave administrator cannot see inside your organisation unless you grant it.

The MyWave Innovation Hub holds three things:

  • Your users’ account details

  • The prompts you use to describe an agent

  • The resulting agent definition.

It does not hold your business records. When an agent is built, the language model that assists with its design is hosted in the European Union; your prompts are not used to train models and are not shared with the model developer.

Two things follow for you. Treat the MyWave Innovation Hub as a design tool, not a data store: it is the place to describe business rules, not to paste production records. And the runtime inside your boundary is yours to operate, under the shared responsibility model we set out in our system description.

We are explicit about what we assume you do, so there is no gap between us that nobody owns.

What bounds the agent

The question I hear most from security teams is not about prompts. It is whether an agent will act outside its intended bounds, and whether the code we ship could be tampered with on its way to you.

Our answer to the first is the design model itself: an agent’s connections and permitted actions are set when it is designed, before it is deployed, and the runtime executes that definition.

Our answer to the second is release discipline, described below, and we are extending it so that every runtime and agent package you install can be verified against what we built.

How we build and ship

Changes to the platform go through peer review and automated build and test before they can be released. Dependencies and container images are scanned for known vulnerabilities on every change, and what we find is fixed to a fixed timetable.

Our developers do not have production access; a release is tagged and approved before it is deployed, which keeps the people who write the code separate from the people who run it. Independent penetration testers assess the platform, and findings are tracked to closure.

The MyWave Innovation Hub itself is monitored around the clock by our hosting provider, with logging, intrusion detection and backups that are restore-tested.

Our information security policy

MyWave’s leadership is committed to protecting the information entrusted to it by customers, partners and staff, and to proving that commitment with evidence rather than assertion. Security is managed in proportion to our size and risk, with a small set of controls the team operates every month.

We meet our legal, regulatory and contractual obligations for information security and improve our management system continually.

Every control has someone accountable for it; policies are reviewed within twelve months; people know their obligations on joining and annually; known weaknesses are fixed on time or carry a recorded acceptance; and every high risk is decided, not left open.

This statement is drawn from our Information Security Governance Policy, approved by our Chief Executive.

Who stands behind this

Information security at MyWave is governed from the top. Our Chief Executive is accountable for it, I am responsible to her for the programme, and the board oversees security within its oversight of enterprise and technology risk. We operate to a stated risk appetite, we run a formal risk assessment and we review it, and we hold the engineering team to a published set of policies that I own and the CEO approves.

Independent assurance confirms that we do what we say. MyWave holds a SOC 2 Type 1 report, examined by Prescient Assurance, LLC against the AICPA Trust Services Criteria for Security as of 9 October 2026.

We are implementing an ISO/IEC 27001:2022 information security management system with an accredited certification body engaged.

A SOC 2 Type 2 examination, which tests that our controls operate over time, and ISO/IEC 42001, the standard for AI management systems, follow.

The report and our detailed documentation are available to customers, prospective customers and partners under NDA through this Trust Centre.

What we will not share, and why

We do not publish or share our internal risk assessments, vulnerability scans, penetration test findings or our internal policy documents, and we do not permit customers to test our platform. That is not evasion; it is the same rule your own security team applies to your estate.

What we will share, under NDA, is the SOC 2 report, our system description, our completed questionnaire, an architecture overview and our tester’s confirmation of what was tested, when, and that findings are closed. Our information security policy statement is published on this page.

And we will answer your questionnaire, walk your security team through the architecture, and put me on a call with your CISO so the questions above get answered by a peer, early, before they slow the deal down.

Deepak Veerasamy
Chief Information Security Officer, MyWave

FAQs

  • MyWave has completed a SOC 2 Type 1 examination, performed by Prescient Assurance, LLC, against the Trust Services Criteria for Security as of 9 October 2026. A SOC 2 Type 2 examination is our next step. The Type 1 report is available under NDA. To access, fill out the request form.

  • The MyWave.ai system, delivered through the MyWave Innovation Hub. It reviews our system description and whether our controls are suitably designed to meet the Security criteria.

  • Not yet. We are implementing an ISO 27001-aligned ISMS, and our next milestone is a Stage 1 audit.

  • Yes. Our completed security questionnaire answers most standard questions and is available under NDA.

  • In the United Kingdom for the MyWave Innovation Hub; the MyWave runtime operates in your environment. See Privacy and data protection.

  • Yes, independent testers assess our application annually. A letter from the tester confirming the scope, date and closure of the test is available under NDA. We do not share findings. To access, fill out the request form.

  • Global systems integrators: info@mywave.ai. SAP Business One partners: b1@mywave.ai.

  • Email trust@mywave.ai