Security

Your account and your data

• Encrypted in transit. All traffic between you and Wavn runs over encrypted connections.
• Your rows are yours. Access to stored data is scoped to the account that owns it, enforced at the data layer itself — not just in application code.
• Private connections stay private. A connection marked as yours cannot be read by anyone else on the account, including whoever set the account up.

What Wavn's own hands are allowed to touch

• Nothing it did not create. On connected services, Wavn manages only its own items. It cannot edit or delete an event you or anyone else made — a rule enforced by the scopes it requests, not by restraint.
• The minimum, requested upstream. For a private calendar Wavn asks the provider for availability only; your event titles are never received, so they cannot be stored, leaked or subpoenaed from us.
• Mail is verified before it is trusted. The mail door checks that a message genuinely came from where it claims before checking whether the sender is allowed — because anybody can type a From line.

How we handle our own keys and credentials

Credentials are rotated when there is any doubt, verified by live proof rather than by assumption, and every replacement is confirmed against a fingerprint before the old one is destroyed. We treat "it should be fine" as a finding of nothing.

What we do not claim

Wavn does not currently hold third-party security certifications, and this page will not pretend otherwise. When an audit or certification is completed, it will be named here with its date. A security page that overstates is itself a vulnerability.

Reporting a vulnerability

If you believe you have found a security issue, email report@wavn.app with "Security" in the subject line. Please include what you found, how you found it, and how we can reproduce it. Do not test against accounts or data that are not yours. We read these first, and we will tell you honestly what we did about it.