Trust
Security and data handling
Wavefront publishes to your site and reads your search data, so we keep each workspace's data apart and encrypt the credentials you connect. Withdrawing a post, billing and team changes need a person signed in to the web app.
Workspace isolation
- Every record belongs to one workspace, and every query is scoped to it through one data-access layer.
- An automated check fails the build if code queries the database outside that layer.
- API keys and agent connections reach only their own workspace. Requests for another workspace answer as if it doesn't exist.
Credentials and secrets
- Destination tokens and keys, OAuth refresh tokens, Slack and Microsoft Teams webhook URLs and webhook signing secrets are encrypted at rest with AES-GCM, and the app never shows them to you again after you save them.
- API keys and session tokens are stored only as SHA-256 hashes. API keys are compared in constant time.
- We keep platform secrets in Cloudflare's secret store instead of in the code.
Sign-in
- Sign in with Google or a six-digit email code that lasts five minutes and works once. We store only its HMAC.
- Wrong guesses retire a code, repeated failures lock the address for an hour, and sign-in endpoints are rate limited per IP.
- Starting a sign-in answers the same way for every address, so it never reveals who has an account.
Permissions
- Owners, editors and viewers get what their role allows, from one permission matrix used by the web app, the API and MCP.
- Withdrawing, billing, team changes and turning on auto-approve need a person signed in to the web app. Owners and editors can approve through their agent, and an API key only with the approve scope.
- API keys carry only the scopes an owner gives them. Agents sign in with OAuth and a consent screen.
Audit trail
- Every version is immutable and records the documents, sources and prompt version it was written from.
- Approvals, publications and withdrawals are recorded with who did them and when.
- Owners see audit events for API keys, destinations and limits.
The web app
- The app is served over HTTPS from Cloudflare's network, with a strict Content Security Policy.
- It loads only its own scripts, plus Cloudflare's cookieless analytics beacon, and can't be framed by other sites.
- Outgoing webhooks are signed with HMAC-SHA256 under the Standard Webhooks scheme.
Your data
How we use your data
We use workspace content and Google data only to provide the features you turn on.
- We don't sell personal information, workspace content or Google user data.
- We don't use workspace content or Google user data to train AI models.
- AI providers process inputs under terms that don't let them train on them.
- Search Console and Analytics access is read-only, and Drive opens only the files you pick. Each permission is asked for only when you turn on its feature, and revoked when an owner disconnects.
- Synced Search Console and Analytics data is a rolling 28-day snapshot, plus weekly totals that show how your site changes over time.
- When a workspace is deleted, its content, connections and tokens are deleted within 30 days.
The details are in the Privacy Policy, and every provider is on the subprocessors list.
Report a security issue
If you find a vulnerability, email security@adwave.com with the steps to reproduce it. Please give us a reasonable time to fix it before you share it, and don't access data that isn't yours. We'll confirm we received your report and keep you updated.
Publish your next post with your team's sign-off
Start a 7-day trial with 300 credits and every feature, no card needed. After that it's $99 a month.