Privacy, sovereignty and data protection

MyWave does not process our customers' data. MyWave provides an agentic platform — the Innovation Hub for designing agents and a runtime for operating them. Customers and their partners build their own agents on the platform and deploy them inside their own environment. Enterprise, employee and customer data is processed by the runtime under the customer's control, within the customer's security perimeter, and is never transferred to or accessible by MyWave.

Our role: MyWave is a software provider, not a data processor. The customer is the data controller and determines what agents are built, where they run, and under what policies they process data. For this reason, a Data Processing Agreement is not required for the MyWave runtime.
What MyWave holds: The MyWave Innovation Hub holds account data for the designers and administrators who use it (name, work email, role and access logs) and the agent definitions they create. MyWave is the data controller for this account data, which is handled under our privacy policy. The Innovation Hub is a design environment and is not intended for live or production data.
Hosting and sub-processors: The Innovation Hub is hosted on Google Cloud Platform in the United Kingdom, with Azure OpenAI as the model provider for design-time assistance. At runtime, agents call the LLM model you choose, from your environment.
International transfers: MyWave does not transfer customer data across borders, because it never holds it. Innovation Hub account data may be processed in the regions above under the safeguards set out in our customer terms.
Retention and deletion: Innovation Hub account data and agent definitions are retained for the term of the agreement and deleted within 30 days of termination, unless the law requires otherwise. Data processed by the runtime in your environment is governed entirely by your own retention policies.
Privacy policy

Sovereignty and control

MyWave is built on the principle that the enterprise — not the platform — owns and controls its data, its agents and the decisions they make.

You build the agents: Agents are designed and configured by you or your partner, using your business knowledge and your policies. MyWave provides the platform; it does not build, see or operate your agents.
Runtime in your environment: Agents execute where your data is. The MyWave runtime runs inside your estate — on-premises, in your private cloud or in your public cloud subscription — and MyWave has no access to it.
Air-gapped and on-premises deployment: For defence, critical infrastructure and other highly regulated environments, the full MyWave runtime and a local LLM can be deployed on-premises with no external connectivity. Agents operate entirely within the secured perimeter.
Choice of model: You choose the model and where it runs — a hyperscaler-hosted model, a regional endpoint, or a fully local LLM or sovereign model in your own data centre.
Sovereign hosting: For customers with data-residency or national sovereignty requirements, the runtime can be hosted in-country through accredited local hosting partners.
No training on your data: MyWave never sees your data and does not use it to train or improve MyWave models or any foundation model.
Governed agents: Every agent operates within policy, role and permission boundaries you define, with human-in-the-loop controls for consequential actions and a full audit trail of what each agent did, with which data, and why — held in your environment.
Your IP, your agents: MyWave owns its platform IP; you own your data and the agents, processes and configurations you build on it. Nothing is shared across customers.

Subprocessors

We use a limited number of third parties to deliver our service. Each is assessed for security and bound by data protection terms. The live list is now populated on the Vanta Trust Center page. We give 30 days' notice before adding a new subprocessor.

Responsible disclosure

We welcome reports from security researchers. If you believe you have found a vulnerability, email trust@mywave.ai with enough detail for us to reproduce it. We ask that you do not access or modify customer data, disrupt our service or disclose the issue publicly before we have resolved it.

We will acknowledge your report within two business days and keep you updated.

FAQs

MyWave has completed a SOC 2 Type 1 examination, performed by Prescient Assurance, LLC, against the Trust Services Criteria for Security as of 9 October 2026. A SOC 2 Type 2 examination is our next step. The Type 1 report is available under NDA. To access, fill out the request form.
The MyWave.ai system, delivered through the MyWave Innovation Hub. It reviews our system description and whether our controls are suitably designed to meet the Security criteria.
Not yet. We are implementing an ISO 27001-aligned ISMS, and our next milestone is a Stage 1 audit.
Yes. Our completed security questionnaire answers most standard questions and is available under NDA.
In the United Kingdom for the MyWave Innovation Hub; the MyWave runtime operates in your environment. See Privacy, sovereignty and data protection
Yes, independent testers assess our application annually. A letter from the tester confirming the scope, date and closure of the test is available under NDA. We do not share findings. To access, fill out the request form.
Global systems integrators: info@mywave.ai. SAP Business One partners: b1@mywave.ai.
Email trust@mywave.ai

Privacy, sovereignty and data protection