Your data stays yours.
This is the single source of truth for how Perfect Wiki protects customer data, runs its service securely, and meets its obligations to you. Read the policies, check sub-processors, request a DPA (Enterprise plan), or report a vulnerability — all from here.
- Hosting
- Google Cloud · US, Ireland, Germany
- Encryption (transit)
- TLS 1.2+ with PFS
- Encryption (rest)
- AES-256 (GCP) + AES-256-GCM secrets
- Authentication
- Microsoft Entra · Google · email OTP
- Backups
- Encrypted daily · 60-day retention
- Account deletion
- Honored within 30 days
The answers your security team is going to ask for.
We've answered the IT-review questionnaire thousands of times. Here's the short version — encryption, hosting, identity, monitoring, backups, and what happens to your data when you leave.
Encryption in transit
TLS 1.2+ with perfect forward secrecy on every endpoint, terminated at Cloudflare and re-encrypted to origin.
Encryption at rest
AES-256 full-disk on Google Cloud for all customer data. Application-layer secrets are additionally wrapped with AES-256-GCM.
Authentication & SSO
Microsoft Entra and Google Workspace SSO plus passwordless email OTP. MFA is inherited from your identity provider.
Hosting & residency
Google Cloud Platform — US, Ireland, and Germany regions. Enterprise customers may pin data residency to a specific region.
Backups & restore
Encrypted daily backups retained up to 60 days, with a documented restore procedure that we test on a recurring schedule.
Environment separation
Production, staging, and development environments are fully isolated. Production data is never used for non-production purposes.
24/7 monitoring
Automated monitoring and alerting via Sentry, scheduled-job check-ins, and uptime monitoring on our public status page.
Export & deletion
Self-service HTML export at any time, including after termination. Customer-initiated account deletion is honored within 30 days.
Where we are today — no hand-waving.
We're a small, profitable company. We follow the controls under frameworks like SOC 2 and ISO 27001 and track toward formal certification as we grow — and we tell you honestly what's done, what's in progress, and what isn't in scope.
- GDPRPublic sub-processor list, data-subject requests honored, EU data hosted in the EU. DPA signed for Enterprise customers.
- CCPACalifornia residents' rights are honored under our Privacy Policy.
- CSA CAIQ v4.0.3Self-assessment available to customers and prospects on request.
- Data Processing AgreementEnterprise planStandard GDPR DPA. Signed only for customers on the Enterprise plan.
- SOC 2Not yet certified. We follow the underlying controls and are tracking toward formal certification.
- ISO 27001Not yet certified. Controls implemented and policies maintained per the standard.
- HIPAAPerfect Wiki is not designed for Protected Health Information.
- PCI DSSWe do not store, process, or transmit payment card data — billing is handled by FastSpring and Paddle.
- FedRAMPWe are not designed for U.S. federal workloads.
The full list of who touches your data — and why.
Each sub-processor below is bound by a contract requiring confidentiality and appropriate security measures, including a GDPR-compliant DPA where applicable. Enterprise plan customers under a signed DPA are notified at least 30 days before a new sub-processor begins processing personal data.
Written down, reviewed annually, approved by leadership.
Every policy below is reviewed and re-approved at least annually by the CEO/CTO. We share the full text with prospects under NDA during procurement.
- 01Information Security Policy
- 02Access Control & Identity Management
- 03Cryptography & Key Management
- 04Data Classification, Retention & Deletion
- 05Incident Response Plan
- 06Business Continuity & Disaster Recovery
- 07Change & Configuration Management
- 08Vulnerability & Patch Management
- 09Vendor & Sub-processor Management
- 10Risk Management
- 11Human Resources Security
- 12Secure SDLC
- 13Asset Management
- 14Logging & Monitoring
- 15Acceptable Use
The links your procurement team is going to ask for.
Documents you can hand directly to legal, IT, or your security reviewer — no NDA gating required.
Data Processing Agreement
Standard GDPR DPA with Standard Contractual Clauses for international transfers. Signed only for customers on the Enterprise plan.
Request the DPASub-processors
Current list of third parties that may process customer data, with purpose, data category, and location. Updated as our stack evolves.
See the listVulnerability disclosure
Found a security issue? We commit to acknowledging within 3 business days and triaging within 10. Safe-harbor terms included.
Report a vulnerabilityStatus page
Real-time uptime, incident history, and scheduled maintenance for every Perfect Wiki service.
Open the status pageHave a security question we didn't answer here?
Email us at hello@perfectwiki.com for security questionnaires, DPAs, sub-processor questions, or anything else your team needs to clear procurement. We respond within one business day.
Stop being the person who answers the same question every week.
Join 10,000+ companies who've turned their messy SharePoint folders into an AI agent everyone on the team can use.