Security, privacy & compliance at Waaqi
This page is maintained by Waaqi to answer common security and privacy questions about the Waaqi platform. It describes the controls we operate today and our shared responsibilities with customers; it is not an independent certification.
Platform & Hosting
Waaqi runs on hardened cloud infrastructure with isolated tenants, encrypted storage, and TLS in transit. Production access is restricted to authorised personnel using SSO and MFA.
Access & Authentication
Customer accounts support email/password and SSO. Administrators can enforce MFA, manage role-based permissions, and review audit logs of sensitive actions.
Data Collection & Use
We process only the data customers upload into their workspace, plus the minimum account and usage telemetry needed to operate and secure the service.
Subprocessors & Integrations
Waaqi uses a limited set of vetted subprocessors for hosting, email, analytics, and AI inference. A current list is available on request.
Cookies & Analytics
We use first-party cookies for session management and privacy-respecting analytics to improve the product. See our Privacy Policy for details and consent options.
Retention & Deletion
Customer data is retained for the life of the subscription and deleted on request or at contract termination, subject to legal retention obligations.
Privacy Requests
Data subjects can exercise access, correction, and deletion rights by contacting our privacy team. We respond within the timelines required by applicable law.
Incident Response
Waaqi maintains a documented incident response process. Confirmed incidents affecting customer data are communicated to impacted customers without undue delay.
Vulnerability Reporting
If you believe you have discovered a security vulnerability in Waaqi, please email security@waaqi.ai. We acknowledge reports within two business days.
Compliance
Waaqi is designed to help customers meet obligations under PDPL, GDPR, ISO/IEC 27001, ISO/IEC 42001 (AIMS), NCA ECC, SAMA CSF, ADHICS, and similar frameworks. Customers remain responsible for their own compliance posture.