Security

Last updated: September, 2026

Ace Waves builds and operates AI agents that handle customer conversations on behalf of our customers. That means we routinely process personal data and confidential business information, and protecting it is a core part of the product, not an add-on. We run a formal Information Security Management System (ISMS) certified against ISO/IEC 27001:2022, and we try to be transparent about how it works.

This page summarizes how we protect customer data. For evidence, including certificates, audit reports, policies and the current sub-processor list, visit our Trust Center.

Certifications and compliance

Our ISMS is reviewed by management at least annually, audited internally every year and audited externally by an accredited certification body.

Audit reports, penetration test summaries and completed security questionnaires are available to customers and prospects through the Trust Center.

Data residency and hosting

Ace Waves is built in Lithuania and the platform runs exclusively on Google Cloud Platform in the European Union. All application data, including conversation logs, knowledge bases and configuration, is stored in EU regions.

Google is responsible for the physical security and environmental controls of the data centers that host our systems and maintains independent attestations against ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, SOC 1/2/3 and PCI DSS.

AI model processing. We do not host or train our own foundation models. Large language models are consumed as managed services from established providers listed in our sub-processor list. In the default configuration these providers may process requests outside the EU. Customers who need strict EU-only processing can opt in to EU regional endpoints. Where cross-border transfers occur they are covered by Standard Contractual Clauses or an equivalent legal basis, disclosed in our sub-processor list.

Encryption

• In transit. TLS 1.3 for all client-to-service and service-to-service communication.

• At rest. AES-256 for all stored data, applied by default across every storage service we use. Backups are encrypted with the same standard.

• Key management. Keys are managed in our cloud provider's key management service, with access controlled and audited separately from the data they protect.

Application security

The application layer is our highest-risk surface, and our secure development policy applies to everyone who builds or maintains the platform.

• Secure development lifecycle. All changes are version-controlled and go through documented change control. No code reaches production without passing automated testing.

• Code and dependency scanning. Source code, dependencies and container images are scanned continuously for known vulnerabilities, and critical findings block deployment.

• Vulnerability remediation. Findings are triaged, owned and remediated on a defined SLA based on severity.

• Penetration testing. Independent third-party penetration tests are conducted at least annually against the production environment, and again after significant changes. Executive summaries are available under NDA via the Trust Center.

• Runtime protection. A web application firewall and rate limiting protect production endpoints against common attack patterns, including the OWASP Top 10.

• Session security. User sessions time out after inactivity and require re-authentication, and session tokens are protected against tampering.

AI-specific safeguards

Because our product is an AI agent acting on real customer conversations, we treat model behaviour as part of the security boundary.

• Tenant isolation. Each customer gets fully isolated agents running in separate environments. Agents cannot access another customer's data.

• No training on customer data. We never use customer data to train models, ours or anyone else's.

• Prompt injection defense. We apply layered defenses, including architectural separation between user input and agent instructions, non-LLM guardrails that constrain agents to predefined procedures, and treating all user input as untrusted.

• Guardrails and human handover. Guardrails monitor every conversation for restricted topics and flagged language, and can refuse, adjust or hand over to a human agent with full context according to rules the customer defines.

• Provider resilience. The platform supports multiple model providers, so agents can be moved to an alternative model if a provider has an outage.

Infrastructure and network security

• Segmentation. Development, staging and production environments are strictly separated.

• Hardening. Systems and networks are provisioned against documented hardening standards, and network rules are reviewed regularly.

• Monitoring. Centralized logging captures authentication, access and administrative events. Alerts route to on-call engineers. Logs are retained per policy and protected against tampering.

• DDoS protection. Edge protection is provided by our cloud provider and is active by default.

• Vulnerability management. Infrastructure is scanned continuously. Findings are triaged, owned and remediated against defined SLAs.

Identity and access management

• Internal access follows least privilege and role-based access control, and is reviewed at least quarterly.

• Privileged access to production requires multi-factor authentication, is approved by the asset owner and is audit-logged.

• Employee onboarding and offboarding access changes are completed within one business day.

• In the platform itself, customers manage their own users through Editor and Admin roles. Authentication is via passwordless magic link or Google sign-in by default, with SAML and OIDC single sign-on against the customer's identity provider available on request.

People security

• Background checks are conducted for new hires where legally permitted.

• All employees and contractors sign confidentiality agreements as a condition of engagement.

• Security awareness training is mandatory at onboarding and annually thereafter, with role-specific training for engineers and administrators.

• Acceptable use, data classification and remote work policies are in force and acknowledged by all staff.

Vendor and sub-processor management

We assess every vendor that handles customer data before engagement and re-assess on a defined cadence, based on the risk the vendor represents. Vendor contracts include information security commitments, sub-processor disclosure and breach notification terms. Our current sub-processor list, including processing purpose and data location, is published in the Trust Center. We notify customers of material sub-processor changes in line with our Data Processing Agreement.

Incident response

We maintain a documented incident response plan covering detection, containment, eradication, recovery and post-incident review. The plan is reviewed and tested at least annually.

In the event of a confirmed security incident affecting customer data, we will notify affected customers without undue delay and within the timeframes required by GDPR and our Data Processing Agreement. Communication is delivered through your designated security contact.

Report a security incident or suspected compromise: security@acewaves.com.

Business continuity and disaster recovery

• Customer data is backed up daily, encrypted and stored redundantly. Backups are periodically restored to verify they work.

• Recovery objectives (RTO and RPO) are defined and tested at least annually.

• Our business continuity plan covers personnel, supplier and infrastructure failure. Because we are a remote-first, cloud-hosted company, the loss of an office does not interrupt operations.

Data retention and deletion

Customer data is retained for the duration of the agreement. During the contract, customers can request custom retention rules, for example automatic deletion of conversation data after a defined period. Within 60 days of termination all customer data is permanently deleted from production systems, and backup retention follows the schedule documented in our Data Processing Agreement. Customers retain full ownership of their data and of any metadata generated through use of the platform.

Individuals may exercise their rights under GDPR (access, rectification, erasure, portability, restriction, objection) as described in our Privacy Policy, or through the controller of their data when Ace Waves acts as processor.

Customer responsibilities

Security is a shared responsibility. As a customer, you are responsible for:

• Configuring authentication for your users. We recommend single sign-on through your identity provider with multi-factor authentication enforced.

• Protecting credentials, API keys and integration secrets issued to you.

• Maintaining accurate security and administrator contact details so we can reach you in an incident.

Responsible disclosure

We welcome reports from security researchers. If you believe you have found a vulnerability in our application or infrastructure, please email security@acewaves.com with:

• A clear description of the issue and the affected component.

• Steps to reproduce, including a proof of concept where possible.

• Your contact information for follow-up.

Scope and rules of engagement:

• Test only against accounts and data you own.

• Do not run automated scanners against production beyond what is necessary to demonstrate the issue.

• Do not access, modify or exfiltrate other users' data.

• Do not publicly disclose the issue until we have confirmed remediation.

We will acknowledge receipt within two business days and will not pursue legal action against researchers who follow this process in good faith. We do offer rewards for valid vulnerability reports, depending on severity and impact. However, we do not provide rewards for low-impact issues (e.g., missing security headers, self-XSS, clickjacking on non-sensitive pages, outdated libs without known exploits).

Information Security Policy

Our ISMS is governed by a formal Information Security Policy, approved by management and reviewed at least annually. The policy commits Ace Waves to:

• Protecting the confidentiality of customer and company information against unauthorized disclosure.

• Maintaining the integrity of information against unauthorized modification.

• Ensuring the availability of information to authorized users when needed.

• Granting access on a least-privilege basis, with privileged access strictly controlled and reviewed regularly.

• Meeting and, wherever possible, exceeding applicable legal, regulatory and contractual requirements.

• Continually improving the ISMS through corrective actions that improve its effectiveness.

• Developing, maintaining and testing business continuity plans.

• Providing security training to all employees and embedding security responsibilities into role descriptions.

• Protecting employees who report security concerns in good faith from retaliation.

• Investigating and responding to all reported or suspected information security breaches.

The full policy set and supporting standards are available to customers and auditors via the Trust Center under NDA.

Contact

Ace waves, UAB, Gedimino g. 22A-14, LT-44319 Kaunas, Lithuania