Privacy, subprocessors, disclosure and FAQ
Privacy and data protection
MyWave acts as a data processor for customer data and processes it only on our customers' documented instructions. Our Data Processing Agreement (DPA) sets out our obligations, including security measures, subprocessor use, breach notification and data subject requests. Our DPA is included in our customer terms.
Data location: Customer data is stored in the United Kingdom for the MyWave Innovation Hub. The MyWave runtime operates in your environment.
International transfers: Where data is transferred outside the United Kingdom, the transfer mechanism is set out in our customer terms.
Retention and deletion: Customer data is retained for the term of the agreement and deleted within 30 days of termination, unless the law requires otherwise.
Subprocessors
We use a limited number of third parties to deliver our service. Each is assessed for security and bound by data protection terms. The live list is now populated on the Vanta Trust Center page. We give 30 days' notice before adding a new subprocessor.
Responsible disclosure
We welcome reports from security researchers. If you believe you have found a vulnerability, email trust@mywave.ai with enough detail for us to reproduce it. We ask that you do not access or modify customer data, disrupt our service or disclose the issue publicly before we have resolved it.
We will acknowledge your report within two business days and keep you updated.
FAQs
-
MyWave has completed a SOC 2 Type 1 examination, performed by Prescient Assurance, LLC, against the Trust Services Criteria for Security as of 9 October 2026. A SOC 2 Type 2 examination is our next step. The Type 1 report is available under NDA. To access, fill out the request form.
-
The MyWave.ai system, delivered through the MyWave Innovation Hub. It reviews our system description and whether our controls are suitably designed to meet the Security criteria.
-
Not yet. We are implementing an ISO 27001-aligned ISMS, and our next milestone is a Stage 1 audit.
-
Yes. Our completed security questionnaire answers most standard questions and is available under NDA.
-
In the United Kingdom for the MyWave Innovation Hub; the MyWave runtime operates in your environment. See Privacy and data protection.
-
Yes, independent testers assess our application annually. A letter from the tester confirming the scope, date and closure of the test is available under NDA. We do not share findings. To access, fill out the request form.
-
Global systems integrators: info@mywave.ai. SAP Business One partners: b1@mywave.ai.
-
Email trust@mywave.ai