Whisperly - Trust Center

Data is retained only for as long as necessary to fulfill business purposes or comply with legal requirements. When data is no longer needed, it is securely deleted using approved methods that prevent recovery. Regular audits ensure compliance with retention schedules.

All sensitive data is encrypted in transit using industry-standard protocols like TLS 1.2 or higher. Data at rest is encrypted using AES-256 encryption, and encryption keys are managed securely with regular rotation schedules.

Source code changes are logged, time-stamped, and attributed to their author in a source code management tool. Access to the source code tool is restricted to authorized users using multi-factor authentication.

The organization maintains an incident response plan that defines responsibilities, detection methods, and corrective actions during security incidents. Various monitoring tools are used for early detection, and the plan is tested, reviewed, and updated at least annually.

The organization adheres to the principle of least privilege, giving team members access only to information necessary for their job functions. Requests for privilege escalation require documented approval by an authorized manager, and regular audits of access privileges to sensitive applications are performed.