TRUST CENTER

Your data is encrypted both in transit (between the browser and our servers) and at rest (when stored on our servers). We use AES-256 bit encryption while transferring your data to/from our servers and for storing data on our servers. AES-256 is the industry standard for storing and transferring sensitive data. All backups of your data are also encrypted using AES-256 bit encryption. We use TLS 1.3 to encrypt your data both between your browser and our servers and between our servers and other internal networks.

Yes, we use Amazon Web Services (AWS), Google Cloud Platform, and other industry-leading cloud providers to store and process your data in the cloud.

We use Amazon Web Services (AWS) and Google Cloud Platform as our primary cloud infrastructure providers, and our core infrastructure is hosted on these services under Data Processing Agreements. We do not hold Business Associate Agreements with these providers, so no PHI is stored on Woltrio infrastructure; healthcare projects run in environments covered by our clients' own agreements.

We have GDPR Data Processing Agreements with vendors that process personal data on our behalf. No third-party vendor processes protected health information (PHI) for Woltrio, so we do not hold vendor BAAs; we sign a HIPAA Business Associate Agreement directly with each healthcare client.

We have multi-factor authentication, role-based access controls (RBAC), IP whitelisting, and least privilege principles in place to restrict unauthorized access to data. Our cloud providers adhere to strict SOC 2 Type II auditing and reporting standards for managing access to data stored in their systems. All access is logged and monitored 24/7.

Yes, these providers are mandated to provide options (which we utilize) to completely wipe data from their servers. We ensure complete data deletion upon request in compliance with GDPR and other privacy regulations.

Data is replicated across multiple redundant servers in different geographic regions within our environment, which mitigates the risk of loss of connectivity or data loss. We maintain multi-region redundancy with automated failover capabilities to ensure business continuity.

Third-party services are outlined in our Privacy Policy and Trust Center. Updates to this list of providers are communicated via our Privacy Policy updates and through the Subprocessors section of our Trust Center.

When you request deletion of your data, we will erase it from our primary databases immediately. Data will remain in encrypted backups for up to 30 days as part of our disaster recovery procedures. We have automated batch processes to purge backups within a rolling 30-day cycle. After 30 days, your data is permanently and irreversibly deleted from all systems.

Yes, you can export your data at any time. We provide data portability in compliance with GDPR and other privacy regulations. Your export will be provided in standard formats (JSON, CSV, or PDF) that include all data associated with your account. Contact our support team to request a data export.

Yes, we can provide a comprehensive audit log of all access and transfer of your data upon request. We maintain detailed logs of all data access for security and compliance purposes. In general, we will only access your data at your request to assist with troubleshooting issues related to your use of our services.

Yes. We design and build software to meet GDPR requirements — privacy by design, documented data subject rights workflows, data minimisation and sub-processor transparency in the systems we deliver. GDPR compliance is something your product achieves, not a certificate a vendor holds; Woltrio's independently certified standard is ISO/IEC 27001:2022. A Data Processing Agreement (DPA) with Standard Contractual Clauses (SCCs) is available upon request for projects where we process personal data on your behalf. Contact legal@woltrio.com.

Yes. We build healthcare software designed to meet HIPAA requirements — the technical safeguards such as encryption, access controls and audit logging, plus PHI handling built into your product. HIPAA compliance is something your organisation and product achieve, not a certificate a vendor holds; Woltrio's independently certified standard is ISO/IEC 27001:2022. Contact legal@woltrio.com to discuss a Business Associate Agreement (BAA) for projects that involve PHI.

Yes. Woltrio's information security management system is certified to ISO/IEC 27001:2022 by G-CERTI, an IAS-accredited certification body (certificate no. GKPK-0328-IC, first issued 9 April 2026). The scope covers the design, development, deployment and provision of our software solutions, including healthcare software, AI systems, cloud solutions and API integrations. The certification is maintained through annual surveillance audits. You can view the certificate and its verification details in the ISO/IEC 27001:2022 section at the top of this page.

Yes. Woltrio is registered with the Pakistan Software Export Board (G) Ltd. under the Ministry of Information Technology & Telecommunication, Government of Pakistan, as a company/firm (registration no. Z-25-13327/25, valid February 2026 – January 2027, renewed annually). You can view the certificate and verify it on PSEB's portal in the PSEB registration section of this page.

Woltrio is not itself a PCI DSS-assessed entity. Card payments are processed by Stripe, a PCI DSS Level 1 Service Provider, so cardholder data never touches Woltrio's servers. Software we build for clients is designed to keep card data inside the payment processor's scope in the same way.

Yes. We sign a HIPAA Business Associate Agreement (BAA) with healthcare clients before PHI is shared. Contact legal@woltrio.com if you need a BAA or have specific concerns about regulations outlined by your governing body.

Woltrio holds ISO/IEC 27001:2022 certification (G-CERTI, certificate no. GKPK-0328-IC), maintained through annual third-party surveillance audits. We build client software to meet HIPAA and GDPR requirements, process payments through PCI-compliant providers, and we build systems designed to support your SOC 2 audit.

No, your data is never used to train AI models. The data we store and process is strictly used for providing our services to you. We do not sell, share, or use your data for any purpose other than delivering the services you've contracted for. When we use AI services from providers like OpenAI or Anthropic, we use enterprise agreements that explicitly prohibit the use of your data for model training.

We use AI services from OpenAI and Anthropic for specific features like code generation, content assistance, and automation. All AI processing is done through enterprise agreements with strict data protection clauses. Your data is processed securely and is never retained by AI providers or used for training purposes.

When AI features are used, your data is encrypted in transit using TLS 1.3, processed through enterprise API agreements with zero data retention policies, and never used for model training. We only send the minimum necessary data to AI services, and processing is designed around GDPR, HIPAA and other applicable regulations.

We have a comprehensive incident response plan that includes immediate containment, investigation, and notification procedures. If a security incident affects personal data, we notify affected clients without undue delay so they can meet their own deadlines: 72 hours to the supervisory authority under GDPR, and without unreasonable delay and no later than 60 days after discovery under HIPAA. Our security team monitors systems 24/7 for potential threats.

Please report any security concerns immediately to security@woltrio.com. We take all security reports seriously and will respond within 24 hours. For urgent security issues, you can also contact our support team directly.

We conduct internal security audits quarterly and undergo annual third-party audits for our compliance certifications (ISO/IEC 27001:2022). Our security controls are continuously monitored and tested. Penetration testing is performed at least annually by independent security firms.

Uptime commitments are agreed per engagement and written into each contract's SLA. We design for high availability with redundancy and 24/7 monitoring. Our infrastructure is distributed across multiple regions with automated failover capabilities. We have a Recovery Time Objective (RTO) of 4 hours and Recovery Point Objective (RPO) of 1 hour.