Trust Center Updates
Trust is easier to extend when you can see what changed and when. This is our running log of material updates to the trust center — most importantly, advance notice of any change to the subprocessors that handle your data. We aim to give reasonable notice before a new subprocessor begins processing customer data; the continuously maintained inventory is available to customers on request.
Trust Center hygiene for diligence walkthroughs
Broken and stale Trust Center copy was aligned with live-repo evidence: legacy /trust* bookmarks redirect to root routes, security.txt is served, acknowledgement language is a 24-hour process target, signed commits are not claimed as enforced, Object Lock rows verify on /security, and PCI SAQ-A copy lives on /confidentiality. Customer-portal links are request instructions, not self-serve packet downloads.
Enterprise diligence dashboard uses live-repo evidence
The public framework-posture walkthrough now leads with repo-verifiable diligence rows (Aligned / engagement pending; zero third-party reports). Seed-fixture readiness percentages and SPRS scores are withheld unless the Confluence snapshot is the primary source. Internal manifest rows are on-disk .compliance.yml files, not mock green validator cells.
Subprocessor list refreshed and simplified
We refreshed our published subprocessor inventory so it precisely reflects the systems that handle customer data today: AWS, Cloudflare, Anthropic, Stripe, GitHub, Atlassian, Google Workspace, and Twilio. We also made explicit what we deliberately keep in-house — connectors, workflow orchestration, observability, and break-glass credentials — to keep the list of third parties short by design.
In-house connector strategy confirmed
We finalized our policy of building integrations on our own connector adapter with first-party OAuth clients, rather than routing customer credentials through a third-party integration broker. No external integration vendor sees customer tokens or data.
Framework alignment published
We published our alignment to SOC 2 Type 2 and ISO/IEC 27001:2022, operating to both under a single Wentzel Compliance Baseline. We describe our status as “Aligned” and will update it to reflect each independent report or certificate once it is in hand.
Looking for the current list of third parties that handle your data? See our subprocessors. Questions about a change here can go to security@wentzel.ai.