wave Trust

Security, privacy, and responsible disclosure for the WAVE platform.

disclosureCoordinated disclosure — see /.well-known/security.txt (RFC 9116) for how to report.
enforcementAuth, scope, entitlement, and metering run at one gateway (api.wave.online); endpoints return 403 when an account is not entitled.
infrastructureBuilt on Cloudflare, Supabase, and Stripe.
privacyData handling, retention, and your rights are governed by our legal terms (privacy, terms, DPA).
Report a vulnerability →

Questions: security@wave.online.