Security at WasteNot.
How we protect the customer data you connect to WasteNot.
- SOC 2 Type II examined
- ISO/IEC 27001:2022 certified
- GDPR independently assessed
- Third-party penetration tested
Trusted by 100+ leading DTC growth teams
Compliance at a glance
The status of each framework and how to get the evidence.
| Requirement | Status | Detail | Access & evidence |
|---|---|---|---|
| SOC 2 Type II | Held | Security, availability, and confidentiality examined for September 1, 2025 through February 28, 2026 | Report on request Request report |
| ISO/IEC 27001:2022 | Certified | Certificate issued March 7, 2026 | Certificate on request Request certificate |
| GDPR | Assessed | Independently assessed as of March 2, 2026 | Assessment on request Request assessmentDPA |
Security
Protected accounts, monitored systems. Two-factor sign-in, a log of every account change, and infrastructure that is scanned and watched continuously.
Multi-factor authentication
Secure accounts with TOTP authenticator apps and one-time backup codes. Staff access to infrastructure always requires MFA.
Breached password detection
Passwords are checked against known breaches during sign-in. If a match is found, we email you to choose a new password. Your password and full hash are never sent to the lookup service.
Audit logs
Every sign-in and account change is recorded with the user, IP address, and action.
Threat detection
Intrusion detection covers every cloud account and region. Repeated failed sign-ins are rate limited and logged.
Vulnerability scanning
Dependencies are scanned on every change and daily. Our live services are scanned weekly.
Data
Your data, under your control. Access, delete, or suppress any customer’s data directly in WasteNot.
Encryption
Encrypted in transit with TLS 1.2+ and at rest with AES-256, across databases, file storage, and secrets.
Data subject requests
Submit access, deletion, and opt-out requests directly in WasteNot, by email, phone, or customer ID.
Suppression list
Add emails, phones, or customer IDs whose data WasteNot will never collect or process.
Network isolation
Production runs in its own isolated cloud account. Customer data lives on private networks with no path in from the public internet.
Frequently Asked Questions
Still have questions? Email info@wastenot.io.