SOC 2
SOC 2 Type I at launch. Type II observation window underway; audit completing within 12 months.
The Type I report is available under NDA on request. The Type II will be issued by an independent auditor to AICPA Trust Services Criteria.
Trust and security
Say what is true, not what sounds impressive.
Day 81 is an agent your CISO can read, your General Counsel can review, and your Procurement lead can sign. The page below is the version we send to all three at the same time.
Compliance posture
GDPR
GDPR-aligned. Data Processing Addenda are available for EU customers. Standard Contractual Clauses are included where transfers leave the EU.
Data subject access requests are handled within 30 days. The right to erasure is implemented at the row level, not the soft-delete level.
EU AI Act readiness
EU AI Act-ready: privacy architecture documented for the high-risk classification expected for employment-domain AI under Annex III.
The classification covers AI used to evaluate or filter candidates, manage workers, or allocate tasks. Day 81’s scope is post-hire integration, not evaluation. The architecture is documented for review either way.
Data-handling commitments
Each commitment is encoded in the codebase or in the runtime, not just on this page.
No training on customer data
Anthropic Claude is the primary model, with documented data-handling that excludes customer prompts and responses from model training. The fallback chain (OpenAI, Gemini) is configured the same way.
Tenant isolation by design
Every database query filters by organization_id. Cross-organization access is the highest-severity damage risk in the codebase and is tested explicitly. No code path exposes another customer’s data through any endpoint.
Privacy-by-default for new hires
New hire content stays with the new hire. Managers see patterns, not transcripts. Open-text pulse responses surface only when a cohort has at least five respondents.
PII redaction in logs
Email addresses, names, and free-text comments are redacted before any prompt is logged. We log SHA-256 prompt hashes for debugging — never the raw prompt.
Encryption in transit and at rest
TLS 1.2+ for all network traffic. Postgres at rest is encrypted by the hosting provider. Secrets live in environment variables, never in code.
Audit log for procurement review
Every mutation is logged with actor, organization, target, and timestamp. The log is exportable in a procurement-grade format for SOC 2 evidence binders.
What the agent will not do without consent
Five actions Wick will never take on its own. Each one is enforced in code, tested, and reviewable by your security and legal teams.
Send a message on a weekend or holiday.
The cadence rule blocks Saturday, Sunday, and observed holidays in the new hire’s time zone. No exceptions, no overrides.
Forward a new hire’s words to a manager.
The manager view shows aggregated patterns only. Transcripts and DM contents stay between Wick and the new hire.
Read a name, photo, or location to alter what it says.
No demographic-aware inference. The methodology applies uniformly. Bias-protective by construction, not by audit.
Take an action on the new hire’s calendar without confirmation.
Calendar holds, meeting drafts, and accept/decline suggestions are proposed for one click. Wick never writes a calendar event without an explicit approval.
Make a recommendation when sources disagree.
When two of your documents conflict on a topic, Wick surfaces both with a "Sources disagree" chip and waits for a human to pick. It never resolves the conflict on its own.
Sub-processors
The list below is the operational sub-processor list. We update it before adding a new processor, and we notify customers under DPA before the change takes effect.
| Sub-processor | Purpose | Region |
|---|---|---|
| — | — | — |
| — | — | — |
| — | — | — |
As of {{date}}
Status
The live status page will be linked here when it is published. Until then, the link anchor is #status. If you need an availability report before then, contact us through the demo form and we will send the most recent uptime summary.
Documents available on request
- SOC 2 Type I report (under NDA).
- Data Processing Addendum (DPA).
- Standard Contractual Clauses (SCCs).
- Privacy architecture summary, written for security review.
- Penetration test summary, most recent.
Talk to us before you procure.
We will walk through the architecture with your CISO, your General Counsel, and your Procurement lead in the same conversation if that is useful.