We take the security of your data seriously. Woven is SOC 2 compliant. In addition to the controls and measures SOC 2 requires, our practices include, but are not limited to:
Access
- Internal tools and admin systems are reachable only over our VPN.
- Traffic to and from third-party providers is IP-restricted wherever the provider supports it.
- On request, we can restrict access to the Woven Dashboard and Woven APIs to your enterprise VPN’s IP addresses.
- Access follows least privilege and is regularly reviewed and audited.
- Workload identity federation instead of long-lived keys wherever possible.
- Secrets are kept in a managed secret store.
Infrastructure
- All public endpoints sit behind DDoS protection and edge filtering.
- Databases have no public IP addresses.
- Rate limiting protects the Woven Dashboard and Woven APIs.
Testing and monitoring
- Regular independent third-party penetration tests.
- Hourly vulnerability scans of our software dependencies.
- Recurring security audits run with frontier AI models.
- Centralized logging and security monitoring (SIEM), with alerting.
- Engineers are on call 24/7, and critical alerts page them directly.
Data protection
- Data is encrypted in transit (TLS 1.2 or higher) and at rest.
- Tenant data isolation is built into our data access layer.
For our SOC 2 report, policies and more, visit the Woven Trust Center.