Compliance

Certifications, GDPR measures, data residency, and how to request compliance documentation.

Wocha is designed for organisations that require strong security, auditability, and regulatory alignment. This page summarises our current compliance posture and how enterprise customers can obtain documentation.

Certification status

Wocha does not yet hold a SOC 2 report or an ISO 27001 certificate. We began a readiness programme for both in September 2026 and will update this page as each milestone is reached.

Certification	Status	Notes
SOC 2 Type II	Readiness programme under way	No auditor engaged yet; a report follows a 3–6 month observation period
ISO/IEC 27001:2022	Readiness programme under way	Target: certification in 2027
HIPAA	Not currently offered	We are not accepting HIPAA-regulated workloads or signing Business Associate Agreements at present
FedRAMP	Not planned	—

Enterprise customers may request a copy of our SOC 2 report under NDA once one has been issued.

Wocha acts as a data processor when you use Wocha Cloud to authenticate your end users. You remain the data controller for your users' personal data.

Measures in place

Data Processing Agreement (DPA) — standard template available at legal/dpa
Lawful processing — we process data only per your instructions via the Customer API and hosted login configuration
Data subject rights — tools to export, update, and delete user identities via Customer API; SCIM provisioning for directory-synchronised attributes
Sub-processors — listed in the DPA; 30-day advance notice for changes
Breach notification — we notify controllers without undue delay and within 72 hours of becoming aware of a personal data breach
Records of processing — maintained internally; summary available on request

For GDPR enquiries, contact privacy@wocha.ai.

Data residency

Wocha Cloud does not currently offer a choice of hosting region, and tenant data is not replicated across regions. Contact sales@wocha.ai for details of where data is processed or for data residency requirements.

Region selection and customer-managed encryption keys are on the roadmap; we will list them here when they are available.

Certifications roadmap

timeline
    title Wocha compliance roadmap (targets)
    2026 Q3 : ISO 27001 and SOC 2 gap assessment : Readiness programme begins
    2027 : ISO 27001 certification audit : SOC 2 Type II observation period and report

Priorities are driven by customer demand and contractual requirements. Enterprise customers may influence roadmap timing through their account team.

Requesting compliance documentation

Document	How to request
DPA (signed)	Download the DPA template or request a countersigned copy via compliance email
Sub-processor list	Included in DPA; updated list emailed on change
Security overview	Security practices (public); detailed architecture pack on request
SOC 2 report, penetration test summary	Not yet available; we will add them here when they are issued

We aim to respond to documentation requests within 5 business days.

Enterprise compliance questionnaire

Enterprise customers often require completion of vendor security questionnaires (SIG Lite, CAIQ, custom spreadsheets).

Process:

Email compliance@wocha.ai with your questionnaire and deadline
We assign a compliance liaison within 2 business days
Completed questionnaire returned within 10 business days (standard) or 5 business days (enterprise priority)
Follow-up calls available for clarification

Include your tenant slug, company name, and primary contact in all correspondence.

Security practices — architecture, encryption, and incident response
Service level agreement — uptime and support commitments
Data Processing Agreement — GDPR processing terms
Status page — current platform availability

Compliance

On this page