Security

Security you can verify rather than take on trust

The strongest security claim an open-source product can make is that you do not have to believe it. The code that handles your documents is public, and a self-hosted deployment never talks to us.

Read the source Report a vulnerability

Posture

What the platform gives you

Data encryption

All data is encrypted at rest and in transit using industry-standard encryption protocols. In a self-hosted deployment you hold the keys.

Access control

Role-based access control with granular permissions, and an audit log of every read, change and export written to your own database.

Auditable by anyone

The full source is public under AGPLv3. Security review does not depend on our assurances — your team can read the code that handles your documents.

No telemetry

A self-hosted instance makes no outbound calls to us. No usage reporting, no licence check, no phone-home. Verify it in the source, or run it with egress blocked.

Shared responsibility

Who secures what

Self-hosted software splits this differently from SaaS, and being vague about the split is how gaps appear. Here is the line, plainly.

What we are responsible for

The security of the code: reviewing contributions, patching dependencies, publishing advisories, and responding to reports of vulnerabilities in Wraft itself.

What you are responsible for (self-hosted)

Your infrastructure, network boundary, backups, key management, patching cadence, and the access policy of your own users. We cannot see or control any of it.

What we take on (managed)

If we host for you, the operational half moves to us — infrastructure, patching, backups and monitoring — under a written agreement rather than this page.

Security questions

Answered straight, including the awkward ones

Is Wraft SOC 2 certified?

No — and any vendor telling you their software is SOC 2 certified is describing it inaccurately. SOC 2 audits an organisation's operating controls, not a codebase. For self-hosted deployments the controls in scope are yours, running on your infrastructure, and Wraft is a component inside your own audit boundary. If you need our managed service within a compliance programme, talk to us about what we can evidence today.

Does Wraft help with GDPR?

Self-hosting materially simplifies it: if data never leaves your infrastructure there is no international transfer to justify and no additional processor to record. Wraft supports the mechanics — export, deletion, retention policy, access logging. The obligations remain yours as controller, and this page is not legal advice.

How do I report a vulnerability?

Email security@wraft.app with the details and, if possible, a reproduction. We will acknowledge it, keep you updated while we investigate, and credit you when the fix ships unless you would rather we did not. Please give us reasonable time to release a patch before publishing.

Can we run it fully air-gapped?

Yes. Wraft requires no outbound connectivity to operate. There is no licence server to reach and no telemetry endpoint, which is what makes classified and isolated regulatory environments viable.

Can we get a penetration test report?

Tell us what your review requires and we will be straight about what exists today versus what we would need to commission. We would rather say 'not yet' than hand over a document that does not answer your question.