---
title: Trust
description: The controls, the suppliers and where the data lives.
canonical: https://welila.com/trust
---

# Trust

The controls that protect a business's facts, the suppliers who process data, and where each one sits.

## Controls

Twelve controls, what implements each and the evidence it leaves behind. Evidence is the point: a control nobody can produce a record for is a claim.

| Control | What it is | Evidence |
| --- | --- | --- |
| Domain ownership | A hostname is served only after its ownership check passes. The check re-runs daily and the hostname is paused the moment it stops passing. | A verification log per hostname, with every check and its result. |
| No cross-tenant serving | Each account gets its own routing target, and the dispatcher serves only from bindings that already verified. | The routing derivation test, run in the release gate. |
| Tenant isolation | One isolate per account at the edge, forced row-level security in both planes, and a single access path that opens a connection inside an account context. | Isolation tests, and the row-level security proof that runs in the build. |
| Signing keys | Keys are generated inside the signing service for their plane. The private halves live in that service's secret store and are reachable only over a binding. | The key inventory, and the revocation drill in the runbooks. |
| Change control | Every change to control plane data is written as a receipt in the record grammar, with who, what and when. | Receipts, exportable by account. |
| Access control | Roles with least privilege, end dates on partner access, support grants that expire, and a step-up check before anything sensitive. | The access review export, and the operator action log. |
| Transport and storage | A certificate per hostname at the edge, encryption at rest on both database planes, and every secret held in the secrets manager rather than in code. | The certificate inventory, and the secret scan results from every run. |
| Incident and availability | A status page, an incident runbook that commits to notice within twenty four hours, and a documented exit for each severity level. | The runbook, and the status history. |
| Sub-processors | Six named suppliers, listed with what each one sees. | The list above, published here and reviewed quarterly. |
| Where data lives | Every account carries a region. Routing holds one row for it, and an alarm fires if a request ever resolves across regions. | The region column on every account, and the alarm configuration. |
| Secrets | One machine identity per service and region, authenticated from the build with a short-lived token rather than a stored key, and a rotation calendar. | The secrets manager audit log, and the scan results. |
| Key custody | One signer per plane. Only the public halves are published in the directory. | The key inventory, with region and rotation dates. |

## Suppliers

Six suppliers process data on Welila's behalf. Each row says what that supplier actually sees. Anything not on this list receives no customer data.

| Supplier | What it sees | Where |
| --- | --- | --- |
| Cloudflare | Every request to every Welila surface, and the page bytes served back. It runs the site, the dashboard, the API, the dispatcher and the reader as compute, and holds the signing keys in its secrets store, bound read-only to the signer. | A global network. Data, keys and logs are pinned to region; compute runs where the request lands. |
| Neon | All stored customer data. The control plane holds organisations, routing, hostnames, domain checks, payment event ids and the public directory. The identity databases hold people: credentials, sessions and invitations. The plane databases hold memberships, facts, sources, reads, claims, journeys and records. | The control plane and the European plane in London. A United States plane in Virginia from the first claim there. |
| Infisical | Secrets only, never customer data. It holds the session secret, the routing pepper and the supplier keys, and hands them to the deploy, which writes each onto its Worker. The database connection strings are resolved from Neon at deploy and are not stored here. | A European cloud. |
| Stripe | Payment data for a paying account: the buyer's name, email address, billing address, card details and the tax position for the sale, which Welila never holds itself. | A United Kingdom entity, processing globally. |
| Resend | Outbound email: the recipient address, the subject and the body of every message Welila sends, and the delivery result. | A European region on the sending domain. |
| Anthropic | The text of a source page the reader fetched, sent for fact extraction, and the text of a question a caller asked of a journey, sent with the business's confirmed facts to answer it. It does not receive account records, contact details or payment data. | United States processing over the standard messages interface with an API key, which carries no retention setting. The account's retention setting has not been read from the console, so this row makes no retention claim until it has. |

## Certification

Welila is not certified yet. These controls are implemented, the evidence is listed, and no third party has reviewed it. The audit is scheduled at incorporation. Every supplier's own certifications are theirs, held on their own trust page.

## Where data lives

The control plane and the European plane are in London. A United States plane in Virginia opens with the first claim there. A person's identity stays in their region, a business's facts stay in the region of the business, and an alarm fires if a request ever resolves across regions.