DPDP-aligned and GDPR-ready today. AES-256-GCM with AWS KMS-managed Customer Managed Keys; TLS 1.3 in transit. AWS Mumbai (ap-south-1) primary. Hash-chained audit logs. Incident playbook in the open. External attestations (SOC 2 Type II, ISO 27001) planned 2026 H2 — we will not claim them until they land.
Three regulatory addenda are live now (DPDP, GDPR, WhatsApp BSP). Two external attestations (SOC 2 Type II, ISO 27001) are planned 2026 H2 — we will publish them the day they land, and we do not cite them until they do.
Audit engagement in progress. Report under NDA when issued.
Planned 2026 H2Pre-audit gap-assessment complete. Independent auditor engaged.
Planned 2026 H2External counsel review. Public DPO & DSR flow.
Active · Reviewed Q1Article 28 DPA + SCCs & UK IDTA on file.
Active · v3.0Tier 1 BSP. Direct on-cloud connection.
Active · VerifiedEvery request is rate-limited, every connection is mutually TLS-authenticated, every read and write lands in a hash-chained audit log. Here's the path your data takes.
Encryption is table stakes. Below is how Wendesk enforces tenant isolation, audit, and industry-specific compliance at the application layer — concretely in code, not in marketing.
The platform admin surface (wd-admin.wendesk.com), tenant dashboard (app.wendesk.com), and marketplace (www.wendesk.com/m/*) operate under independent session-token scopes. A token issued for one surface is rejected by the others — even at the same authenticated identity. Cross-surface confusion attacks fail at signature verification, not at policy.
Every protected route compares the tenant claim in the session token against the tenant slug in the URL. Mismatch returns 403 immediately and writes a SecurityAuditLog entry tagged tenant:confusion-attempt. No session can act on a tenant it was not issued for.
When platform Admin Support staff act on a tenant workspace at the tenant's request, the session is wrapped in an ImpersonationSession record: actor, target tenant, target user, written reason, start, end, and every action taken inside the session. Tenants receive the impersonation report in their monthly compliance digest. (DPDP Article 26 alignment.)
Each tenant is issued a dedicated Data Encryption Key (DEK), wrapped by an AWS KMS-managed Customer Managed Key. Integration credentials, BYOK AI keys, and PHI fields decrypt only with the tenant's DEK in scope. A KMS key revocation cuts every connection touching the tenant within seconds.
Wendesk runs PostgreSQL for ACID-critical state (identity, billing, audit) and MongoDB for tenant business data (CRM, content, integrations). Writes that span both go through a transactional outbox in PostgreSQL plus a relay worker — never a naive try-catch. Cross-DB inconsistency is structurally impossible.
Healthcare workspaces auto-redact PHI before any LLM call. Pharma marketplaces auto-block Schedule X self-fulfilment without prescription proof. Real-estate listings reject without a RERA project ID. F&B storefronts require a valid FSSAI licence before publishing. Industry overlay runs before RBAC permission match in the resolver.
Pick a region at signup. Enterprise customers can pin to a single region with no cross-border replication. Multi-cloud failover at the region level.
A short list — kept short on purpose. Material additions are announced 30 days in advance via email and the trust feed.
| Vendor | Purpose | Region | Data type |
|---|---|---|---|
| Amazon Web Services | Primary cloud — compute, storage, KMS | IN · EU · ME | All tenant data |
| Cloudflare | CDN, WAF, DDoS protection | Global edge | Request metadata only |
| Razorpay | Card & UPI tokenization, billing | IN | Tokenized payment refs |
| Stripe | International billing | EU · US | Tokenized payment refs |
| Meta (WhatsApp) | Cloud API for WhatsApp Business | Global | Conversation data |
| Twilio | SMS & voice fallback | Multi | Phone numbers, messages |
| Anthropic & OpenAI | AI inference (zero-retention) | Multi | Prompts, redacted |
| Sentry | Error tracking, no PII | EU | Stack traces |
Click "Request access" — we'll send under NDA within one working day. No sales call required for the standard pack.
Audit engagement in progress. Subscribe to the issuance notification; report goes out under NDA the moment it lands.
Subscribe to update →Pre-audit gap-assessment complete; certification body engaged. Subscribe to the issuance notification.
Subscribe to update →Envelope encryption with KMS, MFA-gated admin access, hash-chained audit logs, dependency scans, quarterly pen-tests. Available without NDA.
View now →Pre-signed DPA + SCCs + UK IDTA. Counter-signed within 24 hours.
Read the DPA →Live, versioned list with 30-day change notices. Subscribe to the feed.
View live →Business Associate Addendum for healthcare tenants — signed within 24 hours.
Read the BAA →Uptime targets, response-time commitments, and credits per plan.
Read the SLA →Triaged within 24 hours; breach notification under DPDP/GDPR/HIPAA timelines.
Open the form →Access, correction, erasure under DPDP/GDPR — fulfilled within 30 days.
Submit a DSR →Acknowledged within 24 hours, resolved within 30 days (DPDP Article 32).
File a grievance →Privacy, Terms, DPDP, GDPR, Cookies, Acceptable Use, Refunds — single index.
Open the index →Found a security issue on a Wendesk surface? Email [email protected]. We acknowledge in 24 hours, reproduce within 5 working days, and ship fixes on a severity-driven timeline. Good-faith research that follows our policy is exempt from legal action under India's IT Act 2000, the US CFAA, the UK CMA 1990, and equivalent laws. A formal public bug-bounty program is planned for 2026 H2 once the security team is staffed for triage at scale; until then, the email intake is the sole route.
SIG Lite, CAIQ, our currently-implemented controls overview, sub-processor list, network diagrams, and DR results — bundled and sent under NDA. SOC 2 Type II and ISO 27001 reports added once attestations land (planned 2026 H2).