WAIA Security Summary

This Security Summary explains the practical measures Nineteen Point Two uses to protect WAIA and customer data.

It is designed to provide commercial and procurement confidence. It does not represent a formal security certification.

1. Security approach

WAIA is designed around controlled access, role-based permissions, supplier-backed infrastructure and proportionate operational security.

The platform is intended to process ordinary workplace learning and adoption data. It is not intended to process special category data, highly sensitive HR casework, medical records, disciplinary records, financial account information or national identifiers.

2. Access controls

WAIA uses role-based access controls. Typical roles include:

• platform administrator
• organisation administrator
• learner

Organisation administrators and learners have organisation-scoped access. Platform administrators have cross-organisation access to operate and support WAIA.

Platform administrator access is limited to authorised Nineteen Point Two personnel and used to operate, support or secure the service.

3. Authentication

WAIA uses authentication services provided through its configured platform and infrastructure providers.

Customer administrators manage access for their organisation's users.

4. Data segregation

WAIA is a multi-tenant platform. Database row-level security is active on its public tables and supports organisation-scoped access for organisation administrators and learners.

Platform administrators retain intentional cross-organisation access.

5. Infrastructure

WAIA uses third-party infrastructure providers for application hosting, database, authentication, storage, deployment and related services.

WAIA runs on Lovable Cloud, with Supabase database and backend infrastructure managed by Lovable. Lovable also provides authentication emails. Resend delivers invitations, learner nudges and administrator digests. Cloudflare supports hosting and edge infrastructure.

Nineteen Point Two relies on these providers for parts of the underlying security model, including physical security, core infrastructure security, encryption capabilities and service availability.

6. Encryption

WAIA uses HTTPS for data in transit.

Storage security depends on the managed hosting and database infrastructure.

7. Logging and monitoring

WAIA and its providers may generate technical logs for security, troubleshooting, reliability and performance.

Logs may include IP addresses, user identifiers, device information, timestamps, error details and request metadata.

Access to logs is limited to authorised personnel according to operational need.

8. Backups and recovery

Daily database backups are available through the managed infrastructure, with a rolling retention period of approximately 14 days. Point-in-time recovery is not available. Recovery depends on the available backup and the circumstances of the incident; no specific recovery time or absence of data loss is promised.

9. Supplier security

Nineteen Point Two uses suppliers to operate WAIA. Its Data Processing Agreement governs the appointment of subprocessors that process Customer Personal Data.

The Subprocessor List identifies providers processing Customer Personal Data for WAIA.

10. Incident handling

Nineteen Point Two will investigate suspected security incidents and take reasonable steps to contain, assess and remediate confirmed issues.

Where a personal data breach affects Customer Personal Data, Nineteen Point Two will notify the affected customer without undue delay after becoming aware, in line with the Data Processing Agreement.

11. Customer responsibilities

Customers are responsible for:

• choosing appropriate organisation administrators
• removing users who no longer need access
• keeping login credentials secure
• using WAIA in line with internal policies
• avoiding upload of unnecessary sensitive data
• deciding how WAIA records are used internally

12. Security contact

For security questions, contact ben@nineteenpointtwo.com.