Security at WeGuard

• ISO/IEC 27001 certified

  Our information security management system is independently audited and certified to ISO/IEC 27001.

• Encryption everywhere

  Customer data is encrypted in transit with TLS 1.2 or later and at rest with AES-256.

• Secure cloud infrastructure

  The WeGuard platform runs on Amazon Web Services across multiple availability zones, with continuous backups and a tested disaster recovery plan. Customer files are stored with Cloudflare R2.

• Independent testing

  Independent security firms test the WeGuard platform at least once a year, and we scan our systems for vulnerabilities continuously.

• Controlled access

  Staff access follows least privilege, requires multi-factor authentication, and every staff administrative action on production systems is logged.

• Monitoring around the clock

  We monitor WeGuard for threats 24/7 and follow a documented incident response plan.

If you believe you have found a security vulnerability in WeGuard, please tell us. We appreciate the work of security researchers and will work with you to understand and fix the issue.

How to report

Email security@weguard.ai with:

• 01A description of the issue and its potential impact
• 02The affected URL, app, or API, and the version if relevant
• 03Step-by-step instructions to reproduce it, with a proof of concept if you have one
• 04How we can contact you

• 01We will acknowledge your report within 3 business days.
• 02We will send an initial assessment within 10 business days.
• 03We will keep you informed as we work on a fix, and tell you when it is resolved.
• 04With your permission, we will publicly thank you once the issue is fixed.

In scope: weguard.ai and weguard.com, including their subdomains, the WeGuard web console, the WeGuard APIs, and the WeGuard apps and agents for Android, iOS, iPadOS, macOS and Windows.

Out of scope:

• 01Denial-of-service or load testing
• 02Social engineering or phishing of our staff or customers
• 03Physical attacks against our offices or data centers
• 04Vulnerabilities in third-party services we use (please report these to the vendor)
• 05Reports from automated scanners without a demonstrated security impact
• 06Missing security headers, cookie flags, or email (SPF, DKIM, DMARC) settings without a demonstrated security impact
• 07Clickjacking on pages with no sensitive actions, and self-XSS

• 01Test only against accounts and tenants you own or have explicit permission to test. You can create your own free trial tenant at /signup; it runs on the shared production service, so enroll only devices you own and do not run bulk or automated enrollment.
• 02Do not access, change, or delete data that does not belong to you. If you come across someone else's data, stop and tell us.
• 03Do not degrade or disrupt the service for other users.
• 04Give us reasonable time to fix the issue before sharing it publicly. We ask for 90 days, or until a fix is released, whichever comes first.
• 05Follow all applicable laws.

If you make a good-faith effort to follow this policy, we will consider your research authorized, we will not pursue or support legal action against you for it, and we will work with you to understand and resolve the issue quickly. To the extent your research conflicts with our Terms of Use, Master Service Agreement or end user license agreements, we waive those restrictions for good-faith research conducted under this policy. If a third party takes legal action against you for research that followed this policy, we will make it known that you acted in line with it.

We do not run a paid bug bounty program at this time.