Security
How we protect your data.
Honest snapshot of where we are today, what's on the roadmap, and how to report a vulnerability if you find one. No marketing theatre — just facts and gaps.Last updated May 2, 2026
The stack
What runs in production.
Hosting & infrastructure
Application runs on Vercel; databases (Cloud SQL Postgres, Firestore) and identity (Firebase Auth) on Google Cloud, region us-east1. Both providers are SOC 2 + ISO 27001 audited. We don't run our own metal.
Authentication
Sign-in via Firebase Auth. Sessions are 7-day signed cookies minted server-side from the ID token; cookies are HTTPS-only, HttpOnly, SameSite=Lax. Password hashing is delegated to Firebase. SSO (Google Workspace) on the Business plan.
Authorization
Per-organization row-level access enforced by Cloud SQL @auth(level: USER) directives — every read carries the user's auth claims; cross-org reads are physically impossible at the SQL layer. Tool-level role checks (owner / admin / manager / employee) gate every mutation.
Data at rest + in transit
All data encrypted at rest by Google Cloud (AES-256). All traffic served over TLS 1.3. Backups are encrypted and rotated by Cloud SQL's managed backup policy. Stripe handles payment data — we never see card numbers.
Audit log
Every mutation in the app — create / move / delete shifts, member changes, schedule publishes, billing events — is appended to a Firestore audit log. Retention scales with plan: 90 days on FREE / Pro / AI; 7 years on Business. Append-only, never edited.
App Check + abuse prevention
Production traffic from the browser is gated by Firebase App Check (reCAPTCHA v3 attestation) so automated traffic can't hit the Data Connect API directly. Rate limits at the function layer for tool invocations and AI calls.
Compliance
Where we stand.
We'd rather under-promise than print a badge we can't back. Here's the honest matrix:
| Framework | Status |
|---|---|
| SOC 2 Type I | Roadmap — targeting Q3 2026 |
| SOC 2 Type II | Roadmap — after Type I |
| GDPR / UK GDPR | Compliant — see privacy policy |
| CCPA | Compliant — see privacy policy |
| HIPAA BAA | Not applicable — Weekwright stores no PHI |
| PCI DSS | Out of scope — Stripe handles all card data |
Subprocessors
Who else touches your data.
Full subprocessor list with purpose and data scope is documented in our privacy policy. Summary: Google Cloud (hosting + database + auth), Vercel (application runtime), Stripe (billing), Anthropic (Claude API for AI features). No ad networks, no analytics brokers.
Incident response
If something goes wrong.
We disclose security incidents to affected customers within 72 hours of confirmed impact, in line with GDPR Article 33 and CCPA requirements. Notification goes by email to organization owners with the scope, root cause, and remediation steps.
We don't bury bad news. If a vulnerability landed in production we'll say so, what data was at risk, and what we changed to prevent recurrence.
Found a vulnerability?
Email security@weekwright.com with the details — repro steps, affected endpoint, suggested severity. We'll acknowledge within one business day, triage within five, and credit you publicly (with consent) once the fix ships. We don't run a paid bug bounty yet but we don't take research for granted.
Please don't test on real customer data. Use a test organization — we'll create one for security research on request.
Have a security or compliance question we missed?
The privacy policy covers data handling. For everything else, ask.