Privacy & Security
Privacy is a Core Value at Wing.
Learn more in this video with our CEO
Here are just some of the ways we keep you & your data secure
Independently Certified
Wing is ISO 27001 compliant and SOC 2 certified. These aren’t self-declared claims. They’re checked by an outside auditor who reviews the controls behind how Wing handles client data, system access, and platform security.
This means you don’t have to take our word for it. The controls this page describes are the same ones the audit actually checked.
HIPAA Compliance for Healthcare Clients
Wing is HIPAA compliant and signs a Business Associate Agreement (BAA) on every healthcare engagement. This applies whether your assistant is handling scheduling, billing, or any other task that touches protected health information.
This means your patients’ data is handled under the same compliance standards your practice is already required to meet.
Working with EU Customers
When Wing processes personal data on your behalf, our team can work with yours to document the processing arrangement, applicable data-transfer terms and relevant safeguards. We can also discuss service-specific requirements such as managed devices, virtual desktop access and work environments.
This means you’ll have a clear process for documenting how your data is handled, rather than a blanket compliance claim.
Requesting Documentation
Wing can provide SOC 2 and ISO 27001 documentation for vendor security reviews and procurement processes. Contact your account team, or book a free consultation, to request it before your review gets underway.
This means you don’t have to take compliance on faith. Ask, and we’ll send the paperwork.
Request EU Documentation
For EU engagements, Wing can provide our Data Processing Agreement (DPA), applicable Standard Contractual Clauses (SCCs), a list of subprocessors, and a security overview. Contact your account team, or book a free consultation, to request these documents.
This means you can review our EU data-handling commitments in writing before you sign.
PCI Level 1 Compliance
Our payments partner, Stripe, an industry-leading provider, has been audited by an independent PCI Qualified Security Assessor and is certified as a PCI Level 1 Service Provider. This is the most stringent level of certification available in the payments industry.
This means we abide by the most stringent level of certification available in the industry.
How We Handle Your Data
Your data may be stored and accessed in [locations/regions]. Access is limited to [roles/teams]. Where subprocessors are used, they’re [vetting/handling process]. For clients working with our Philippines-based team, [access and transfer arrangement].
This means you can see exactly where your data goes and who’s responsible for it at each step.
Who's Responsible for What
Wing provides: [pending confirmation]
You provide: [pending confirmation]
This means you’ll know exactly which protections Wing manages and which ones are yours to maintain.
Limited Access to Your Data
Access to your data is limited to what’s needed to provide your service. Your data only becomes available to Wing’s AI and to your dedicated assistant, who’s trained and proficient in the AI tools your team already runs on, when you authorize or consent to it.
This means your data isn’t accessed by Wing beyond what’s required to deliver your service, and your assistant only accesses it once you’ve authorized it.
Securing Your Data in Transit
All data in transit between you, your network, and Wing, its technologies, its servers, partners, providers, and all key stakeholders are encrypted via SSL using 2048-bit certificates.
This means your data is protected from being intercepted or read by third parties while it’s in transit.
Encrypted Storage of All Data
Within our systems, all your data is stored using AES-256 encryption with a uniquely derived key for each user, following the recommendations of NIST S.P. 800-132. We encrypt all personally identifiable data.
This means your data stays encrypted at rest, so it can’t be read without the corresponding decryption key.
AES-256 Encrypted Secrets
The most sensitive data, passwords, credentials, identity numbers, and other PII, is stored with our partner, Google Cloud, using Google’s Secrets Manager API in AES-256 format. Wing doesn’t hold that data directly.
This means acquiring this information isn’t practically feasible, and it keeps getting harder as encryption technology improves.
Authentication, Every Time
Every time your account or your device requests or sends data or task requests via Wing or its internal systems, your device’s identity is authenticated and verified with our servers, against a list of authorized devices and corresponding locations we store.
This means device verification adds a layer of protection against someone impersonating you to access your data.
Logging & Auditing
Anytime anyone from Wing, you, or another authorized party views your personally identifiable information, credentials, or any other secure data, even with authorization, it’s logged by Wing. Anytime our systems see strange behavior, it’s flagged for audit.
This means unauthorized access attempts are logged and reviewed, so there’s a clear record of who accessed what and when.
Always Staying Ahead
Privacy and security are core to Wing’s mission. We want our clients to feel at ease trusting us completely, so we invest in security engineering talent and resources dedicated to keeping your data, our platform, and your activity secure.
This means we’re constantly adapting to new threats, and privacy and security shape every decision we make.