Security, Privacy & Compliance
We pledge to keep your data secure, follow security best practices, and never sell or share your data with any third party.
SOC 2 Type 2, GDPR and CASA Tier 2 / Tier 3 compliance
As of April 1, 2024, we are proud to announce our compliance with the AICPA SOC 2 Type 2 standards, ensuring that our systems and processes meet rigorous criteria for security.
Additionally, we adhere to the EU’s GDPR compliance checklist for US companies, affirming our commitment to data protection and privacy for our international users.
Furthermore, WIQ meets the stringent requirements of Tier 2 and Tier 3 of the Cloud Application Security Assessment (CASA) as defined by the App Defense Alliance, built upon the industry-recognized OWASP Application Security Verification Standard (ASVS).
Your data
WIQ is built for enterprises with strict privacy requirements. A lightweight browser extension and desktop app passively capture the interactions needed to reconstruct how your processes are run – and you decide exactly what is captured through allowlist/blocklist controls and capture windows scoped to specific apps, domains, or time periods.
Captured activity is used solely to map your processes and generate automation blueprints. It is never used to train external models, and access is governed by your organization’s retention and residency policies.
WIQ is a process-intelligence tool for building automations, not an employee-monitoring product. Analytics measure process handle times and conformance – not individual performance – and captured data is never sold or shared with any third party.
All data is exchanged between your client and our servers using industry-standard technologies and protocols, encrypted in transit and at rest.
Deleting account and removing all data
We hate to see our users go. You can remove all your data from WIQ from your account settings, or email us at support@getwiq.ai and we will take care of it for you.
What information do we collect?
To build a product that people love, we need to understand how our users use it. We collect basic information such as how many active users we have, which features they use, and the errors that happen so we can fix them.
We use Amplitude to store aggregated usage and telemetry information. We use Statsig for experimentation and dynamic configuration, and Sentry to store anonymized error and crash reports.
For more detailed information, please visit our Privacy Policy page or contact us.
How we secure captured workflow data
WIQ operates within a comprehensive security framework designed for regulated industries, ensuring your workflow data remains protected throughout the observation, understanding, and automation stages.
All workflow event streams captured during the observation phase are handled with the same SOC 2 Type 2 compliant infrastructure that powers the rest of the platform, using TLS 1.2 for in-transit data protection and 256-bit AES encryption for data at rest. The data derived from observed interactions is processed securely to reconstruct process patterns while maintaining strict privacy controls.
The automation blueprints and AI agents generated by WIQ inherit the same stringent security controls that govern the platform, ensuring your workflows maintain confidentiality, integrity, and availability.
Captured workflow data is never sold or shared with any third party, aligning with our core security pledge and GDPR compliance standards.
Controls over what WIQ captures
The WIQ browser extension and desktop app request only the access needed to observe the interactions they are permitted to capture. You stay in control of that scope at all times:
Allowlist / blocklist
You decide exactly which apps and domains WIQ is allowed to capture from. Anything outside the allowlist – or explicitly on the blocklist – is never observed.
Capture windows
Capture can be scoped to specific time periods, so WIQ only observes work during the windows you define and stays dormant otherwise.
Individual controls
In addition to organization-wide admin settings, individual users can start, pause, and stop their own capture, so people decide exactly what data gets captured and when.
Data residency & retention
Captured data is governed by your organization’s data residency and retention policies, and is used only to map your processes and generate automation blueprints. It is never used to train external models, and never sold or shared with any third party.
Encryption and other information
- WIQ uses TLS 1.2 for securing in-transit data as well 256-bit AES encryption at rest on our cloud infrastructure.
- Infrastructure as code: all our infrastructure services are deployed using declarative configuration, all changes are versioned and stored.
- All code changes undergo a peer-review.
- The code is automatically scanned for known security vulnerabilities and patches are applied in a timely manner.
Security contact
Please send any security related information or inquiries (including vulnerability disclosures) to security@getwiq.ai
Frequently asked questions
How does WIQ learn our processes? +
WIQ combines observed work, existing documentation, and input from your team to build process blueprints.
What is a blueprint? +
A blueprint describes the process steps, required tools, and approval points. Your team reviews it before deployment.
Where do the agents run? +
Agents run in your existing AI platform using WIQ blueprints. Deployment depends on the tools and access each workflow needs.
Can we control what WIQ records? +
Admins and users can define which apps and sites WIQ records using allowlists and blocklists.
What happens when our process changes? +
WIQ surfaces process changes and helps your team review and approve blueprint updates before deployment.