Trust & Security

Overview

Wentzel Investments LLC (trading as Wentzel.ai) builds and operates a portfolio of specialized SaaS platforms for regulated industries. Protecting the confidentiality, integrity, and availability of the data you entrust to us is a core obligation — not a feature.

This page describes our current security posture, our SOC 2 status, how we handle your data, the sub-processors we rely on, and how to reach us if you discover a potential vulnerability.

SOC 2 status

Wentzel Investments LLC is SOC 2 aligned: our controls are designed to the AICPA Trust Services Criteria. We are not pursuing a SOC 2 audit, and no SOC 2 report has been issued.

We do not hold a SOC 2 report of any type. SOC 2 issues a report, not a certificate, and no auditor has issued one for Wentzel. We are not pursuing a SOC 2 audit. We do not publish a target date.

Infrastructure & data security

Our production workloads run primarily on Cloudflare Workers, with Cloudflare D1 (SQLite) for structured data and Cloudflare R2 for object storage. Regulated healthcare pathways, batch genomics pipelines, and transactional email run on Amazon Web Services (SES, S3, Batch, Secrets Manager). Select products use Neon (managed Postgres) during migration.

All data in transit is encrypted with TLS 1.2 or higher. Data at rest is encrypted by the storage platform (AES-256). Production systems follow least-privilege access. We enforce per-product database isolation so one product's data is never accessible from another product's runtime.

• Encryption in transit — TLS 1.2+ on all public endpoints.
• Encryption at rest — AES-256 by the underlying storage platform.
• Least-privilege access — scoped IAM roles / Cloudflare API tokens; no standing production write access.
• Per-product isolation — separate D1/R2/database instances per product slug.
• Secret management — runtime secrets managed via Cloudflare Worker Secrets and AWS Secrets Manager; never committed to source control.

Data handling

We process personal data only to deliver the services you have requested, to keep them secure, and to comply with legal obligations. We do not sell personal data, and we do not use customer content to train shared or third-party models.

Data is retained for as long as your account is active or as needed to meet legal and audit-evidence obligations. Live customer data is deleted within 30 days of account termination, and encrypted backups age out within 365 days.

Sub-processors

We engage the following sub-processors to deliver platform services. All sub-processors are under contract requiring appropriate confidentiality and security measures.

• Cloudflare, Inc. (United States) — edge compute (Workers), CDN, D1 database, R2 object storage, DNS, DDoS mitigation.
• Amazon Web Services, Inc. (United States) — transactional email (SES), object storage (S3), batch compute (Batch), secrets (Secrets Manager).
• Stripe, Inc. (United States) — payment processing for products with paid plans.
• Atlassian Pty Ltd (Australia) — customer support ticketing (Jira Service Management) for requests sent through our support forms, help centers and support email.
• Product-specific sub-processors (for example AI model providers, error monitoring, and identity providers) are listed on each product’s own sub-processor page; for Cytra, see /legal/subprocessors.

Reporting a security issue

If you believe you have found a security vulnerability in any Wentzel platform product, please report it responsibly. We will acknowledge your report within two business days and aim to resolve confirmed issues within 30 days, depending on severity.

Please do not publicly disclose a vulnerability before we have had the opportunity to investigate and remediate. We do not currently operate a formal bug-bounty programme, but we will acknowledge researchers who responsibly disclose valid findings.

Email security@wentzel.ai to report a potential vulnerability.