Security
Security at WPMaven
How we protect the business we run for you
You are trusting us with a business: its website, its customers and the accounts it posts from. This page says what we do to protect it, in plain words.
For your security review
We have answered 109 security questions in our own words, covering all 17 domains of the Cloud Security Alliance's CAIQ v4, each mapped to its control. Write to legal@wpmaven.ai and we send them to you, so your review can start right away.
Written security policies
Our security program is written down: 15 policies covering access control, encryption, secure development, vulnerability management, logging, incident response, business continuity, vendors, staff training and risk management. We share 13 of them with customers: write to legal@wpmaven.ai and we send them to you.
Where your data lives
Your WPMaven account, the websites we host for you, their databases and files are stored in the European Union, in Belgium, in the data centers of a major cloud provider, and their backups in the European Union.
Some work happens outside the EU. The AI models that write, design and make videos for your business run mainly in the United States, and so does email delivery. Your website is delivered through a worldwide network that keeps it fast and absorbs attacks. Payments run on Stripe. Our subprocessors page names every company that processes personal data for us, what it sees, where, and the safeguard for each transfer.
How your data is protected
Encrypted in transit and at rest
WPMaven's dashboard and API always use HTTPS, and the websites we host are served over HTTPS. Stored data and backups are encrypted with AES-256, and the keys to your connected social accounts are encrypted a second time by WPMaven itself.
Sign-in without passwords, and a second step when you want it
You sign in with a one-time code we email you, or with your Google account. The code works for 10 minutes, locks after 5 wrong tries, and is stored only as a hash. You can add two-step sign-in in your settings: after the emailed code or Google, you enter a 6-digit code from an authenticator app on your phone, so someone who gets into your email still cannot sign in. Each person on your team signs in as themselves, with the role you give them. Signing out ends your session on our servers, on all your devices.
Each website stands alone
Every site we host runs in its own container with its own limits, and with a database login that opens only its own database.
Nothing goes public without your yes
After your website is first built, no post goes out, no page is published and the team makes no change to your live website until you approve it. Our support team can approve on your behalf only when you ask for help or to fix a problem, and each such approval is recorded under their name. On the sites we host, our WordPress plugin and WordPress's own security releases update automatically.
Staff access has limits
Only staff accounts can open a customer's account. Each visit is recorded in our audit log and lasts at most 60 minutes, and every change made through WPMaven during it is recorded under that person's name. If they open your WordPress admin, they use their own named WordPress administrator account, which loses its access 12 hours after they last used a sign-in link, unless it is the only administrator your site has. Changes made inside WordPress are not in our audit log.
Backups every day
Our database is backed up every day, and every website we host is backed up every night, database and files, to separate storage in the EU.
Checked on every change
Every change to our code is scanned automatically for known vulnerabilities in the software we build on, for leaked secrets and for unsafe code. Before launch we reviewed the security of the whole product (the API, the dashboard, the WordPress plugin and the hosting), and we fix critical and high findings first.
AI and your data
- We do not train AI models on your business, your content or your customers.
- The provider that turns still images into short video clips may, under its terms, use de-identified data to improve its services.
- What you write is sent to the AI as you wrote it, so please keep card numbers, passwords and health details out of your messages.
- Our team reads the business descriptions people type, to improve how WPMaven understands requests. You can ask us to erase yours at any time at privacy@wpmaven.ai.
For procurement, legal and security teams
- Security questionnaire answers: 109 written answers covering every domain of the Cloud Security Alliance's CAIQ v4 questionnaire, ready before your review starts. Write to legal@wpmaven.ai and we send them to you.
- Data processing agreement: under GDPR Article 28, with the Standard Contractual Clauses for transfers, our security measures and our subprocessor list. Read it; we sign it on request.
- Subprocessors: every company that processes personal data for us, with what it does and where.
- Annual order form and partner agreement: on request. Write to legal@wpmaven.ai.
Payments
Stripe handles your payment details on its own secure pages, so your card number never reaches our servers. We never see or store it.
Your data
What we collect, why we collect it and how long we keep it is set out in the Privacy Policy. Every site is standard WordPress, so your business stays portable.
Reporting a Vulnerability
If you find a security problem, write to support@wpmaven.ai with enough detail to reproduce it. We read every report, we will tell you what we found, and we will not take action against good-faith research.