How we keep your team's data safe.

The short version

We inherit security from best-in-class infrastructure providers rather than reinventing it. Full details below.

Data storage & encryption

All customer data is stored in PostgreSQL managed by Supabase. Every database is encrypted at rest using AES-256. Every connection uses TLS 1.3 (or the highest version the client supports).

Files — brain docs, avatars, wrap attachments — are stored in Supabase Storage buckets, each set to private with signed-URL access only. Bucket-level access is scoped to the workspace that uploaded the file.

Passwords are hashed with bcrypt (via Supabase Auth) — we never store or transmit plaintext credentials, and even our administrators cannot see them.

Access controls (RLS)

Every single row of every table in Wrapit's database is protected by row-level security (RLS). This means:

• A doer can only read their own wraps.
• A manager can only read wraps + EODs from workers in their workspace.
• Only workspace owners can change billing.
• Cross-workspace reads are impossible even if an attacker had a valid auth token.

RLS is enforced by PostgreSQL itself, not by our application code. Application bugs can't accidentally leak data between workspaces.

Payments

We use Paddle as merchant of record for all subscription billing. That means:

• Card numbers never touch Wrapit's servers — Paddle collects them directly.
• Paddle is PCI DSS Level 1 certified — the highest tier of payment card security.
• All charges, invoices, refunds, and tax handling are Paddle's legal responsibility, not ours.

We only store metadata — subscription ID, plan tier, renewal date. No card, CVV, or bank details ever pass through our systems.

AI & your data

Your data is never used to train AI models. We use OpenAI's API to generate wrap questions, extract signal from replies, and synthesize EOD summaries. OpenAI's API terms explicitly state that data sent via the API is not used for model training.

Every OpenAI API call is:

• Sent over TLS 1.3
• Scoped to the specific workspace's data (no cross-tenant leakage)
• Deleted from OpenAI's transient logs within 30 days

Content indexed for retrieval (Brain) stays in our database. OpenAI only sees the specific chunks needed to answer a specific question — never your full corpus.

Sub-processors

These are the third-party services we rely on. Each has been reviewed for their security posture. Click any name for their compliance page.

We do not sell customer data to third parties, and we do not use customer data for marketing purposes beyond product improvement.

The trust contract

Wrapit is designed around a simple principle: workers reply honestly because the system protects them.

• Raw wraps stay private — only the manager (and the worker who wrote them) can see the full text.
• Team Pulse summaries posted to Slack are sanitized — burnout signals, blockers, and manager-only content are stripped.
• Workers can review + correct what the AI extracted before it locks at EOD time.
• Pause is self-serve — no manager approval required.
• Manager can't see private Slack DMs — only opted-in public/private channels the workspace admin explicitly indexes.

Data retention & deletion

You own your data. You can:

• Export everything — profile, wraps, EODs, messages — from Settings → Data. Delivered as a JSON archive.
• Delete your account — starts a 14-day grace period, then everything is permanently erased. Cancelable during the grace window.
• Delete your workspace — same 14-day grace, then all members lose access and data is erased.

Deleted data is unrecoverable after the grace period expires. Backups older than 30 days are automatically pruned by Supabase.

Compliance status

Wrapit is pre-audit. We are a solo-founder startup and have not yet completed SOC 2, ISO 27001, or HIPAA certifications. Our sub-processors (Supabase, Paddle, Vercel, OpenAI) are all SOC 2 Type II certified — we inherit meaningful protection from them.

If you require Wrapit to hold a specific certification as a condition of purchase, contact us. We are willing to prioritize audits when customer demand justifies the investment.

For GDPR customers, we sign standard Data Processing Agreements. Request one at hello@wrapit.pro.

Responsible disclosure

If you discover a security vulnerability in Wrapit, please tell us before disclosing it publicly. We will:

• Acknowledge your report within 48 hours
• Keep you updated as we investigate and patch
• Credit you publicly (with your permission) once the issue is resolved
• Not take legal action against good-faith security researchers

We do not yet run a paid bug bounty, but we're grateful for every report and will send a small token of appreciation for meaningful findings.