Security at Wisegrid

Infrastructure & data

• Hosted on managed cloud infrastructure, with all customer data stored in the United States. Our infrastructure providers are listed below.
• Customer data is logically isolated per account; access scoping is enforced in the application layer.
• The application runs as an unprivileged service account (not root), bound to loopback behind a reverse proxy.

Encryption

• In transit: all traffic is encrypted with TLS (Let's Encrypt); HTTP redirects to HTTPS.
• At rest: the production database is a managed cluster that encrypts data at rest (LUKS). Attachments and nightly backups live in encrypted object storage.

Authentication

• Sign in with Google or Microsoft (OAuth). We don't store passwords for social login. Email + password sign-up is also available.
• Payment data is handled entirely by Stripe (PCI-DSS Level 1); Wisegrid never stores card numbers.
• Organizations can enforce enterprise SSO (OIDC and SAML) for their email domain, with just-in-time account provisioning. Included on the one plan, not gated behind an enterprise tier.
• Optional two-factor authentication (TOTP authenticator apps) on password accounts; MFA secrets are stored encrypted.

Data handling & retention

• We store: account/profile data (via your OAuth provider), your sheet/grid content, file attachments, and billing metadata.

Availability & backups

• The production database is backed up automatically every night to encrypted, offsite object storage, with roughly 30 days of retention.
• Backups are restore-tested: we exercise a full restore from a snapshot so a backup is something we can actually recover from, not just a file we hope works.
• File attachments are kept in dedicated object storage and served only through short-lived signed links, never public URLs, so access expires rather than living on an open, shareable address.

Continuity

Wisegrid is built and run by its founder. You should not have to guess what that means for your data, so here it is in writing:

• Your data is never locked in. Any sheet exports to Excel at any time, and the export bundle includes your file attachments. This works on every plan, during and after a trial, with no one's permission needed.
• If Wisegrid ever winds down, we commit to a minimum of 90 days written notice, with the product and exports kept fully available for that entire period.
• Nightly encrypted offsite backups (about 30 days of retention) mean the wind-down promise is backed by more than one copy of your data.

Real numbers

We do not have big-logo customers to show you yet. Rather than pad this page with borrowed credibility, here are the numbers we can actually stand behind, as of August 27, 2026:

• 244 user-facing features shipped since June 2026, each with its real date, on the public changelog. Judge the pace, not the promises.
• 5,142 backend tests must pass before any deploy, plus the frontend suites. The formula engine alone carries 592 tests and a 406-case golden audit behind the 119 functions we guarantee.
• Nightly backups, restore-tested. Roughly 30 daily snapshots retained in encrypted offsite storage at any time, and we have actually run the restore.
• Every comparison number on this site cites a primary source. Competitor limits link to the competitor's own documentation, never to our paraphrase.
• What is missing from this list (SOC 2, customer references) is missing because we have not earned it yet. When we do, it appears here with a date.

Subprocessors

We use a small set of trusted infrastructure providers to run Wisegrid. Listing them is part of being transparent about how your data is handled.

Responsible disclosure

See the Vulnerability Disclosure Policy below. Report security issues to ryan@wisegrid.co. Our machine-readable contact is published at wisegrid.co/.well-known/security.txt.

Compliance roadmap

We are not SOC 2 certified yet, and we won't claim to be. We've architected for it (least-privilege access, encryption in transit, change management through code review) so that pursuing SOC 2 Type 1 (Security criteria) is an evidence-collection exercise rather than a re-architecture. We'll begin that process as we move into the enterprise market. If your procurement process requires SOC 2 today, we're glad to discuss timelines directly.