Security is at the heart of how we build Wizard Application, and we are proud to be Cyber Essentials certified as of June 2026. To mark it, here is a full look at how we protect your data across the platform.
Cyber Essentials certification
Cyber Essentials is a UK Government backed scheme, created by the National Cyber Security Centre and delivered through the IASME consortium, that helps protect organisations against the most common cyber attacks. Our certification covers the five core control areas:
- Firewalls and boundary protection.
- Secure configuration of hardened systems.
- Access control and user permissions.
- Malware protection and threat defence.
- Patch management with regular security updates.
Certifications and compliance
Cyber Essentials sits within a wider programme of certifications and data protection compliance. Today we are certified or compliant with:
- Cyber Essentials, certified June 2026.
- UK and EU GDPR, including the Data Protection Act 2018, and we are on the ICO data controller register.
- US state privacy laws, including CCPA and CPRA, VCDPA, CPA, CTDPA, UCPA, TDPSA, OCPA, and MCDPA.
- LGPD in Brazil, APPI in Japan, and PIPEDA with Quebec Law 25 in Canada.
We are also working towards further independent certifications, and we will announce each one as it is awarded:
- ISO 27001, the international standard for information security management, currently in implementation.
- ISO 27017 and ISO 27018 for cloud security and cloud privacy, following ISO 27001.
- ISO 42001 for responsible AI management.
- SOC 2 Type II, for independent verification of our controls over time.
Infrastructure and encryption
Wizard Application runs on Amazon Web Services, the same trusted cloud that powers banks, governments, and FTSE 100 companies. Your data is placed in the AWS region matching your jurisdiction and stays there.
- All data encrypted at rest with AES-256 and in transit with TLS 1.3 and perfect forward secrecy.
- Encryption keys managed in AWS KMS, and credentials isolated in AWS Secrets Manager.
- Private network with AWS WAF, isolated subnets, and DDoS protection through AWS Shield.
- Daily automated backups with 90-day retention and point-in-time recovery.
- Multi-region disaster recovery with a 4-hour recovery time objective and a 5-minute recovery point objective.
Complete database isolation
Unlike platforms that store every customer in one shared database, each customer receives a completely separate database instance, with their own encryption keys and separate backups. Cross-customer access is impossible by design, which keeps your information private and makes your own audits simpler.
Security controls
- Authentication with multi-factor authentication, passwordless passkeys using WebAuthn, and single sign-on through Google Workspace or Microsoft Entra for Enterprise customers.
- Role-based access control so people only reach what they need.
- Full audit logging of user actions and data access.
- Intrusion detection with AWS GuardDuty and continuous vulnerability scanning with Amazon Inspector.
- Independent penetration testing carried out every year.
Privacy and data residency
Data privacy is fundamental to how we operate. You choose your data residency region at signup, and your data, backups, and processing remain within that jurisdiction for the lifetime of your account. You can access, correct, and delete the personal data we hold, in line with the rights set out in our privacy policy.
You can see the full picture, including our live certification roadmap, on our security page. As we grow, we will keep investing in the certifications and practices that earn and keep your trust.