Trust you can curl.
WAVE's security posture is not a PDF you request from sales. It is a set of live endpoints. Report a vulnerability at the well-known path, read the policy that governs the response, and check for yourself how every paid request is refused. Ten surfaces on this host answer right now, to anyone, without an account.
Start here. It takes ten seconds.
The security contact and the disclosure policy ship as an RFC 9116 security.txt at the well-known path. Not a form, not a gated download. Run this and you have the contact, the expiry, the canonical location, the policy and the acknowledgments page, in that order.
$ curl -s https://trust.wave.online/.well-known/security.txt
Contact: mailto:security@wave.online
Expires: 2027-01-01T00:00:00Z
Preferred-Languages: en
Canonical: https://wave.online/.well-known/security.txt
Policy: https://wave.online/security
Acknowledgments: https://wave.online/security#acknowledgments
What WAVE does not have
WAVE holds no SOC 2 report of its own. This page will not imply one, will not borrow a supplier's, and will not point you at a logo wall that reads like a certification. What it offers instead is a smaller claim you can check without asking anyone: the enforcement is in one place, and the refusals are reproducible from your own terminal.
One gate, and you can watch it refuse
Auth, scope, entitlement and metering are not scattered per-endpoint checks. They run at one gateway that fails closed. Send a key it does not recognise and it refuses with a code and a request id you can quote in an email. Send nothing at all and it refuses differently, quoting the price of the call instead. Neither answer requires an account to reproduce.
$ curl -s -X POST https://gateway.wave.online/v1/voice -H 'authorization: Bearer wv_not_a_real_key' 401 {"error":{"code":"AUTH_INVALID_KEY","message":"authentication required", "next_action":{"type":"authenticate","scheme":"bearer"}, "request_id":"..."}} $ curl -s -X POST https://gateway.wave.online/v1/voice 402 payment required — with an x402 quote in accepts[]
Every refusal is named, and every refusal is traceable. The same two shapes come back from GPU, NDI, transcode and listen, because there is one chokepoint rather than one per product. One thing to audit beats fifty.