Here are just some of the ways we keep you & your data secure
Independently Certified
Wing is ISO 27001 compliant and SOC 2 certified. These aren’t self-declared claims. They’re checked by an outside auditor who reviews the controls behind how Wing handles client data, system access, and platform security.
This means you don’t have to take our word for it. The controls this page describes are the same ones the audit actually checked.
HIPAA Compliance for Healthcare Clients
Wing is HIPAA compliant and signs a Business Associate Agreement (BAA) on every healthcare engagement. This applies whether your assistant is handling scheduling, billing, or any other task that touches protected health information.
This means your patients’ data is handled under the same compliance standards your practice is already required to meet.
GDPR Compliance for EU Clients
Wing is GDPR compliant for clients operating in the EU. This covers how personal data is collected, processed, and stored for any client or user based in the European Union, from initial collection through deletion.
This means your data handling meets EU data protection requirements, wherever your team is based.
Requesting Documentation
Wing can provide SOC 2 and ISO 27001 documentation for vendor security reviews and procurement processes. Contact your account team, or book a free consultation, to request it before your review gets underway.
This means you don’t have to take compliance on faith. Ask, and we’ll send the paperwork.
Securing Your Data in Transit
All data in transit between you, your network, and Wing, its technologies, its servers, partners, providers, and all key stakeholders are encrypted via SSL using 2048-bit certificates.
This means third parties can’t “listen in” or “packet sniff” as your data is in transit over the network.
Encrypted Storage of All Data
Within our systems, all your data is stored using AES-256 encryption with a uniquely derived key for each user, following the recommendations of NIST S.P. 800-132. We encrypt all personally identifiable data.
This means even in the unlikely event our systems are compromised, a malicious actor can’t read any data.
Limited Access to Your Data
Wing’s systems, operations, support teams, and employees don’t have access to your data. Your data only becomes available to Wing’s AI and to your dedicated assistant, who’s trained and proficient in the AI tools your team already runs on, when you authorize or consent to it.
This means Wing can’t access your data or PII until you or your device explicitly authorizes us to do so.
PCI Level 1 Compliance
Our payments partner, Stripe, an industry-leading provider, has been audited by an independent PCI Qualified Security Assessor and is certified as a PCI Level 1 Service Provider. This is the most stringent level of certification available in the payments industry.
This means we abide by the most stringent level of certification available in the industry.
Authentication, Every Time
Every time your account or your device requests or sends data or task requests via Wing or its internal systems, your device’s identity is authenticated and verified with our servers, against a list of authorized devices and corresponding locations we store.
This means a malicious actor trying to send or receive data by pretending to be you won’t be able to.
Logging & Auditing
Anytime anyone from Wing, you, or another authorized party views your personally identifiable information, credentials, or any other secure data, even with authorization, it’s logged by Wing. Anytime our systems see strange behavior, it’s flagged for audit.
This means we ensure no one who hasn’t been authorized to view your information is able to view it.
AES-256 Encrypted Secrets
The most sensitive data, passwords, credentials, identity numbers, and other PII, is stored with our partner, Google Cloud, using Google’s Secrets Manager API in AES-256 format. Wing never holds that data directly.
This means acquiring this information isn’t practically feasible, and it keeps getting harder as encryption technology improves.
Always Staying Ahead
Privacy and security are core to Wing’s mission. We want our clients to feel at ease trusting us completely, so we invest in security engineering talent and resources dedicated to keeping your data, our platform, and your activity secure.
This means we’re constantly adapting to new threats, and privacy and security shape every decision we make.
