Trust & Security

Overview

Wentzel Investments LLC (trading as Wentzel.ai) builds and operates a portfolio of specialized SaaS platforms for regulated industries. Protecting the confidentiality, integrity, and availability of the data you entrust to us is a core obligation — not a feature.

This page describes our current security posture, our SOC 2 status, how we handle your data, the sub-processors we rely on, and how to reach us if you discover a potential vulnerability.

SOC 2 status

Wentzel Investments LLC is SOC 2 Type II aligned: our controls are designed to the AICPA Trust Services Criteria. An independent Type II audit is planned; no SOC 2 report has been issued yet.

We do not hold a SOC 2 report of any type. SOC 2 issues a report, not a certificate, and no auditor has issued one for Wentzel. We do not publish a target date; we will post a link to the report (or a summary for prospects under NDA) on this page only once an auditor has issued it.

Infrastructure & data security

Our production workloads run primarily on Cloudflare Workers, with Cloudflare D1 (SQLite) for structured data and Cloudflare R2 for object storage. Regulated healthcare pathways, batch genomics pipelines, and transactional email run on Amazon Web Services (SES, S3, Batch, Secrets Manager). Select products use Neon (managed Postgres) during migration.

All data in transit is encrypted with TLS 1.2 or higher. Data at rest is encrypted by the storage platform (AES-256). Production systems follow least-privilege access; employee access is reviewed quarterly. We enforce per-product database isolation so one product's data is never accessible from another product's runtime.

• Encryption in transit — TLS 1.2+ on all public endpoints.
• Encryption at rest — AES-256 by the underlying storage platform.
• Least-privilege access — scoped IAM roles / Cloudflare API tokens; no standing production write access.
• Per-product isolation — separate D1/R2/database instances per product slug.
• Secret management — runtime secrets managed via Cloudflare Worker Secrets and AWS Secrets Manager; never committed to source control.

Data handling

We process personal data only to deliver the services you have requested, to keep them secure, and to comply with legal obligations. We do not sell personal data, and we do not use customer content to train shared or third-party models.

Data is retained for as long as your account is active or as needed to meet legal and audit-evidence obligations. Following account termination we make customer data available for export for 30 days, after which we delete it unless required to retain it by law.

Sub-processors

We engage the following sub-processors to deliver platform services. All sub-processors are under contract requiring appropriate confidentiality and security measures.

• Cloudflare, Inc. (United States) — edge compute (Workers), CDN, D1 database, R2 object storage, DNS, DDoS mitigation.
• Amazon Web Services, Inc. (United States) — transactional email (SES), object storage (S3), batch compute (Batch), secrets (Secrets Manager).
• Stripe, Inc. (United States) — payment processing for products with paid plans.
• Atlassian Pty Ltd (Australia) — customer support ticketing (Jira Service Management) for requests sent through our support forms, help centers and support email.
• Product-specific sub-processors (for example AI model providers, error monitoring, and identity providers) are listed on each product’s own sub-processor page; for Cytra, see /legal/subprocessors.

Reporting a security issue

If you believe you have found a security vulnerability in any Wentzel platform product, please report it responsibly. We will acknowledge your report within two business days and aim to resolve confirmed issues within 30 days, depending on severity.

Please do not publicly disclose a vulnerability before we have had the opportunity to investigate and remediate. We do not currently operate a formal bug-bounty programme, but we will acknowledge researchers who responsibly disclose valid findings.

Email security@wentzel.ai to report a vulnerability, or reach us through the contact page.