Security - how we keep your data safe
Tenant isolation, HMAC-signed bridges, UK GDPR compliance, encryption at rest and in transit. The technical posture in plain English.
Tenant isolation
Every garage on Wiki is a tenant. Every conversation, transcript, custom KB entry, and rating is row-scoped to its tenant ID; row-level security in SQL Server enforces this at the database boundary, not just at the application layer. A bug in our code cannot leak one tenant’s data into another’s view - the database refuses to return it.
Encryption
In transit: TLS 1.2+ on every public endpoint. Internal services bind to loopback only;
nginx terminates TLS at the edge. At rest: SQL Server transparent data encryption, with
operational credentials (Twilio, Stripe, Groq) stored encrypted in a dedicated
integration_setting table rotated from the admin portal without redeploy.
Bridge auth
Inbound traffic from our voice/SMS subaccount is HMAC-SHA256 signed with a per-deployment shared secret, a five-minute replay window, and a 24-hour idempotency window. Every bridge call is independently authenticated; a leaked token is rotated by editing one row in the admin portal.
UK GDPR
MOT Logs Ltd is the data controller (ICO ZC133502). Lawful basis is contract for customer data, legitimate interest for service operation. We do not train models on your transcripts. You can export or delete your data at any time - see the privacy policy for the full posture, retention windows, and sub-processor list. Hosting is UK; data residency options are available on Enterprise.
Incident response
A 24/7 SMS alerts the engineering on-call when a tier-1 path breaks. Customer-impact incidents are written up on the status page within an hour of resolution; a root-cause post-mortem with timeline, mitigation, and follow-up actions lands within seven working days. Public summary copy is taken from our internal incident response playbook.
More
Questions about a specific control? Email info@motlogs.com. See also our privacy policy and the company page.