Security for regulated industries
Weeki protects your data with defence-in-depth security, EU-only hosting, and compliance frameworks trusted by banking, pharma, and public-sector organisations.
Security built into every layer
Four pillars of defence-in-depth protection, from physical infrastructure to application-level controls.
{ "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "Infrastructure Security" } }
{ "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "Hosted on Google Cloud in the Paris region (France)." } }
- { "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "Google Cloud data centres in the Paris region (europe-west9)" } }
- { "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "Virtual private cloud with network isolation" } }
- { "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "Automated patching and hardening" } }
- { "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "DDoS mitigation at network edge" } }
{ "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "Data Protection" } }
{ "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "Your data is encrypted everywhere -- in transit, at rest, and during processing. Customer data is logically isolated and never used for model training." } }
- { "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "TLS 1.3 in transit, AES-256 at rest" } }
- { "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "Customer-managed encryption keys (BYOK) on Enterprise plan" } }
- { "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "Logical tenant isolation with strict namespace boundaries" } }
- { "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "No use of customer data for AI model training" } }
{ "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "Access Control" } }
{ "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "Fine-grained, role-based access enforced at every layer. Integrate your identity provider for seamless, auditable access." } }
- { "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "SSO via SAML 2.0 and OpenID Connect" } }
- { "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "Active Directory / Azure AD synchronisation" } }
- { "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "Role-based access control (RBAC) with custom roles" } }
- { "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "Mandatory MFA for all admin accounts" } }
{ "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "Monitoring & Incident Response" } }
{ "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "Continuous observability with structured incident management. Every action is logged, every anomaly investigated." } }
- { "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "Immutable audit logs with 12-month retention" } }
- { "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "Real-time anomaly detection and alerting" } }
- { "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "Documented incident response plan (< 1 h initial triage)" } }
- { "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "Post-incident review and customer notification per GDPR Art. 33" } }
Your data stays in Europe
Weeki is hosted on Google Cloud in the Paris region (France). Customer data are stored in the EU; some sub-processors, such as the AI provider, may process data outside the EU under the safeguards listed in our terms.
- { "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "Our hosting provider and our other sub-processors are listed, with the safeguards for any transfer, in Appendix 2 of our General Terms and Conditions." } }
- { "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "All backups are geo-redundant within French territory." } }
- { "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "Data Processing Agreement (DPA) available on request, with Standard Contractual Clauses for sub-processors." } }
- { "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "Compatible with Schrems II requirements -- no exposure to US CLOUD Act." } }
Compliance & certifications
We align with the frameworks that matter to regulated European enterprises.
{ "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "General Data Protection Regulation" } }
{ "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "Full compliance with EU data protection regulation. Data minimisation, purpose limitation, right to erasure, and data portability are enforced by design." } }
{ "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "EU Artificial Intelligence Act" } }
{ "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "Model registry, risk classification, documentation, and human oversight capabilities aligned with Art. 6 and Art. 9 obligations for high-risk AI systems." } }
{ "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "Information Security Management" } }
{ "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "Our information security management system follows ISO 27001 controls. Formal certification is on our 2026 roadmap." } }
{ "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "Service Organisation Controls" } }
{ "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "Weeki does not hold SOC 2 certification." } }
{ "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "Digital Operational Resilience Act" } }
{ "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "ICT risk management, incident reporting, and third-party oversight capabilities support financial institutions' DORA obligations." } }
{ "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "Network & Information Security Directive" } }
{ "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "Access control, audit logs and incident notification support your own NIS2 obligations." } }
Security practices
How we build, test, and operate the platform securely.
{ "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "Encryption everywhere" } }
{ "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "TLS 1.3 for all data in transit. AES-256 encryption for data at rest across databases, object storage, and backups. Key rotation on a 90-day cycle." } }
{ "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "Penetration testing" } }
{ "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "Annual third-party penetration tests conducted by an independent security firm. Critical findings are remediated within 48 hours. Summary reports available under NDA." } }
{ "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "Vulnerability management" } }
{ "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "Continuous dependency scanning (SCA), static application security testing (SAST), and container image scanning in our CI/CD pipeline. CVEs triaged within 24 hours." } }
{ "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "Secure development lifecycle" } }
{ "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "Code review required for all changes. Automated security checks in CI. Developers complete annual secure coding training. OWASP Top 10 coverage." } }
{ "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "Backup & disaster recovery" } }
{ "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "Automated daily backups with geo-redundancy within France. Recovery Point Objective (RPO) of 24 hours, Recovery Time Objective (RTO) of 4 hours. Tested quarterly." } }
{ "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "Incident response" } }
{ "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "Documented incident response plan with defined severity levels. Initial triage within 1 hour. Customer notification within 72 hours per GDPR Article 33. Post-incident reviews for all P1/P2 incidents." } }
Enterprise security features
Built for IT and security teams who need control and visibility.
{ "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "SSO & SAML" } }
{ "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "SAML 2.0 and OpenID Connect integration. Azure AD, Okta, Google Workspace, and custom IdP support." } }
{ "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "RBAC & Permissions" } }
{ "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "Granular role-based access control. Custom roles, workspace-level permissions, and document-level access policies." } }
{ "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "Audit Logs" } }
{ "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "Immutable, searchable audit trail for all user actions, API calls, and admin changes. Export to your SIEM." } }
{ "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "API Security" } }
{ "t": 0, "b": { "t": 2, "i": [ { "t": 3 } ], "s": "OAuth 2.0 API authentication. Rate limiting, IP allowlisting, and scoped API keys with automatic rotation." } }
Have questions?
Find Your Answers Here
Need more details?
Request our security whitepaper or schedule a dedicated review with our security team.