Security Policy

1. Overview

Security is a core commitment at Wayfield. We implement technical, organizational, and physical measures to protect personal data, payment information, and platform integrity. Our security practices are aligned with ISO/IEC 27001 information security management principles and are reviewed and updated at least annually, or following any significant security event.

This document is intended to give users, organizers, and enterprise customers a clear and honest account of our security posture. Where you believe you have identified a vulnerability or security concern, please refer to Section 6 (Vulnerability Disclosure).

2. Infrastructure Security

Wayfield is hosted on managed cloud infrastructure from enterprise-grade providers with certified physical security, redundant power, and high-availability networking. Our infrastructure security includes:

• All data stored at rest is encrypted using AES-256 encryption
• All data transmitted between users and the platform is encrypted in transit using TLS 1.2 or higher
• DDoS mitigation is applied at the network and application layers
• Production environments are logically separated from development and staging environments
• Automated security patching is applied to operating systems and infrastructure components
• Database access is restricted to application servers within a private network; no direct public access is permitted

3. Access Controls

Wayfield applies the principle of least privilege across all internal systems. Access to production systems and customer data is granted only to personnel who require it for their role and is reviewed periodically.

• Multi-factor authentication (MFA) is mandatory for all administrative accounts and all access to production infrastructure
• Role-based access control (RBAC) is enforced in both the application and at the infrastructure level
• Remote access to production systems is via encrypted VPN or bastion host only
• All access events to production systems are logged and retained for audit purposes
• Access rights are revoked promptly upon role change or staff departure
• Third-party contractors with access to production systems are subject to equivalent access controls and confidentiality obligations

4. Application Security

Wayfield applies security best practices throughout the software development lifecycle. Our application security measures include:

• Mitigations for all OWASP Top 10 vulnerabilities, including injection, broken authentication, and cross-site scripting (XSS)
• Parameterized queries throughout the application to prevent SQL injection
• Input validation and output encoding on all user-supplied data
• Content Security Policy (CSP) headers to restrict resource loading and reduce XSS impact
• CSRF protection on all authenticated state-changing requests
• Automated dependency scanning for known vulnerabilities, with updates applied on a regular schedule
• Code review requirements for all changes to production code, including security-focused review for sensitive areas
• Secrets (API keys, database credentials) stored in encrypted secret management systems — never in source code

5. Monitoring and Incident Response

Wayfield operates continuous monitoring of the platform to detect anomalies, unauthorised access attempts, and potential security incidents.

Monitoring

• 24/7 automated monitoring of application and infrastructure health, error rates, and security events
• Alerting systems notify the on-call engineering team of anomalies outside normal parameters
• Application logs are centralised, retained, and reviewed for suspicious activity

Incident Response

• Wayfield maintains a documented incident response plan, reviewed and tested at least annually
• Confirmed personal data breaches are notified to the relevant supervisory authority (ICO in the UK) within 72 hours of discovery, as required by UK GDPR
• Affected users and/or organizer customers are notified of breaches where required by law, without undue delay
• Post-incident reviews are conducted to identify root causes and implement corrective measures

6. Vulnerability Disclosure

Wayfield operates a responsible vulnerability disclosure program. We welcome good-faith reports from security researchers and the wider community.

How to Report

If you believe you have discovered a security vulnerability in the Wayfield platform, please report it to us at security@wayfieldapp.com. Please include:

• A clear description of the vulnerability and its potential impact
• Steps to reproduce the issue (proof-of-concept where possible)
• Any affected URLs, endpoints, or system components
• Your contact details for follow-up

Our Commitments to Researchers

• We will acknowledge receipt of your report within 5 business days
• We will work with you to understand and validate the report
• We operate a 90-day coordinated disclosure window: we ask that you do not publicly disclose the vulnerability until we have had 90 days to investigate and remediate
• We will not take legal action against researchers who act in good faith and follow responsible disclosure guidelines
• We do not currently offer a paid bug bounty, but we appreciate and acknowledge contributions from the security community

This program does not extend to social engineering attacks, physical security testing, or attacks on systems or data belonging to third parties.

7. Payment Security

Wayfield does not store, process, or transmit full card numbers, CVV codes, or other sensitive payment card data on its own servers. All payment card processing is handled exclusively by Stripe, Inc., which maintains PCI-DSS Level 1 certification — the highest level of compliance in the payment card industry.

When you enter payment details on Wayfield, those details are sent directly and securely to Stripe using Stripe.js tokenisation. Wayfield receives only a non-sensitive token that represents your payment method. This architecture means that even in the event of a Wayfield system breach, no card data is exposed from Wayfield’s systems.

Organizer payouts are handled via Stripe Connect. Organizer bank account details are held by Stripe and are not accessible to Wayfield staff.

8. Backup and Recovery

Wayfield maintains automated, encrypted backups of all production data to ensure business continuity and to protect against data loss:

• Full database backups are taken daily and stored in encrypted form in a geographically separate location
• Backup restoration procedures are tested quarterly to verify recoverability
• Recovery Time Objective (RTO): 4 hours — we target restoration of the platform within 4 hours of a catastrophic failure
• Recovery Point Objective (RPO): 24 hours — in a worst-case scenario, no more than 24 hours of data may be lost
• Backup access is restricted to authorised operations personnel only

9. Employee Security

People are a critical part of any security program. Wayfield maintains the following people-focused security practices:

• Background checks are conducted for all employees who have access to production systems or customer data, in accordance with applicable employment law
• Security awareness training is provided to all employees at onboarding and refreshed at least annually
• All employees read, understand, and sign Wayfield’s information security policy upon joining
• Employees are required to report suspected security incidents immediately to the security team
• Disciplinary procedures are in place for policy violations, up to and including termination

10. Third-Party Audits and Penetration Testing

In addition to our internal security measures, Wayfield engages external security firms to independently assess our security posture:

• Penetration testing of the Wayfield platform is conducted periodically by qualified external security firms
• The scope of penetration tests includes web application, API, and infrastructure components
• Findings from penetration tests are reviewed by Wayfield leadership and tracked to remediation
• Critical and high-severity findings are prioritised for remediation within defined SLAs

Enterprise customers who require access to penetration testing reports or security assessment summaries may request these via security@wayfieldapp.com. Summaries are provided subject to a signed non-disclosure agreement.

11. Contact

For all security inquiries, vulnerability reports, or requests for additional security documentation:

• Security team email: security@wayfieldapp.com
• General legal: legal@wayfieldapp.com
• Company: Wayfield, Inc.
• Address: 638 Bates Ave., St. Paul, MN 55106

Related documents:

• Privacy Policy
• Data Processing Agreement
• Sub-Processor List