Your people data deserves serious protection.
Trust, transparency and responsible insight belong at the heart of a platform built around people.
What are “production controls”?
- What it means
- Checks that confirm the protections described on this page work in the live service people actually use, not only on paper or in tests.
- Why it matters
- Until they are done, this page describes how Wispout is meant to work. It is not a guarantee or a certification.
- Who sets it up
- The Wispout team runs and records these checks before publishing any assurance. As a visitor, you do not need to configure anything.
- If nothing is done
- Nothing changes for you, but the statements on this page stay unverified. If your organisation needs a firm answer, ask us through the contact page.
These checks look at Wispout’s systems, not at people. They do not monitor anyone.
Insights should strengthen teams, not monitor people.
Connection patterns give you a starting point for a conversation. They should never become a hidden judgement or an automated performance score.
Privacy by design
Build around purpose, choice and transparency. Designed with GDPR principles in mind as a product direction, not a claim of certification or a legal conclusion.
Data isolation
Organisation boundaries should be explicit and enforced in the production application. Confirm tenant isolation, access rules and data flows before making an assurance.
Access controls
People and administrators should have permissions that match their role and a clear understanding of who can see what. Roles in the live service still need to be verified (see “production controls” above).
Encryption
Production transport and stored-data protection must be documented and tested. This static website does not provide an encrypted product database or process real product data.
Authentication
Connect verified authentication services and document session, recovery and SSO behaviour. The sign-in and signup pages here are frontend previews.
Auditability
Relevant administrative actions should be accountable and proportionate. Confirm what is logged, who can access it and how long logs are retained.
Data exports
People and organisations need a clear process for appropriate access and export requests. The actual export capabilities and request channels must be confirmed.
Data retention
Retention should match a documented purpose, with deletion and organisation settings reviewed before launch. No product retention period is asserted here.
Infrastructure
Document production providers, hosting locations, backups and incident processes using verified information. No provider, residency guarantee or certification is assumed.
A question about trust? Let’s talk.
Ask about privacy, access and the requirements that matter to your organisation.