Security, data and compliance
What transits, what is stored
| Data | At Wave Up | Duration |
|---|---|---|
| Sex, height, weight, area | Session, in memory, encrypted | 2 h at most |
| Drawings and answers | In memory, during computation | A few seconds |
| Result, images, PDF | In memory, encrypted | 15 min after retrieval |
| Resume bundle | Only on your side | Never stored by Wave Up |
| Usage counters, technical logs | Wave Up database | No health data |
- Identity: Wave Up receives no identifying data (name, date of birth, identifier). Your
referenceis opaque. - Logs: they contain no request body, no authorization header and no full address, which automated tests verify.
- Component: it writes nothing to browser storage. Its fonts are hosted with it: no third-party service is called from the patient's device.
Keys and tokens
- Secret key (
wu_sk_…): it is used server-side only. Wave Up only keeps a fingerprint of it. A revoked key is rejected immediately. Several keys can be active at once, so they can be rotated without downtime. - Client token: it is specific to one session, lasts as long as it, and only gives access to that session's component routes.
- CORS: only the Wave Up component can call the
/v1/embed/*routes from a browser. Your server routes accept no call from a page.
Computations stay at Wave Up
No formula, scoring rule or computation constant is shipped to the browser, which is checked at every build of the component. Integration contracts forbid reverse engineering and systematic extraction, and usage limits apply.
Data protection
Processing pseudonymised health data makes Wave Up your processor under the GDPR. A data processing agreement sets out the roles. The service is intended for certified health-data hosting (HDS).