Trust
Security and data handling
Wavefront publishes to your site and reads your search data, so it is built to keep each workspace separate, keep credentials unreadable, and keep the decisions that matter with people.
Workspace isolation
- Every record belongs to one workspace, and every query is scoped to it through one data-access layer.
- An automated check fails the build if code queries the database outside that layer.
- API keys and agent connections reach only their own workspace. Requests for another workspace answer as if it doesn't exist.
Credentials and secrets
- Destination tokens and keys, OAuth refresh tokens, Slack and Microsoft Teams webhook URLs and webhook signing secrets are encrypted at rest with AES-GCM and never shown back.
- API keys and session tokens are stored only as SHA-256 hashes. API keys are compared in constant time.
- Platform secrets are held in Cloudflare's secret store, never in code.
Sign-in
- Sign in with Google or a six-digit email code that lasts five minutes and works once. Only its HMAC is stored.
- Wrong guesses retire a code, repeated failures lock the address for an hour, and sign-in endpoints are rate limited per IP.
- Starting a sign-in answers the same way for every address, so it never reveals who has an account.
Permissions
- Owners, editors and viewers get what their role allows, from one permission matrix used by the web app, the API and MCP.
- Approving, withdrawing, billing, team changes and turning on auto-approve need a person signed in to the web app.
- API keys carry only the scopes an owner gives them. Agents sign in with OAuth and a consent screen.
A record of everything
- Every version is immutable and records the documents, sources and prompt version it was written from.
- Approvals, publications and withdrawals are recorded with who did them and when.
- Owners see audit events for API keys, destinations and limits.
The web app
- Served over HTTPS from Cloudflare's network, with a strict Content Security Policy.
- The app loads only its own scripts, plus Cloudflare's cookieless analytics beacon, and can't be framed by other sites.
- Outgoing webhooks are signed with HMAC-SHA256 under the Standard Webhooks scheme.
Your data
Used for your site, and nothing else
Workspace content and Google data are used only to provide the features you turn on.
- We don't sell personal information, workspace content or Google user data.
- We don't use workspace content or Google user data to train AI models.
- AI providers process inputs under terms that don't let them train on them.
- Search Console and Analytics access is read-only, and Drive opens only the files you pick. Each permission is asked for only when you turn on its feature, and revoked when an owner disconnects.
- Synced Search Console and Analytics data is a rolling 28-day snapshot, plus weekly totals that show how your site changes over time.
- When a workspace is deleted, its content, connections and tokens are deleted within 30 days.
The details are in the Privacy Policy, and every provider is on the subprocessors list.
Report a security issue
If you find a vulnerability, email support@adwave.com with the steps to reproduce it. Please give us a reasonable time to fix it before you share it, and don't access data that isn't yours. We'll confirm we received your report and keep you updated.
Publish your next post with your team's sign-off
Start a 7-day trial with 300 credits and every feature. No card needed. Then $99 a month.