Trust
Where we actually stand
Waterfall holds some of the most personal material a person can give: their life, in their own voice. You should know exactly how it is handled and exactly what we have not finished yet.
We are in trials, and not yet certified
Waterfall is running pilot deployments. We are not SOC 2 certified, and we are not operating under a HIPAA Business Associate Agreement today. Both programmes are underway and neither is finished. We would rather tell you that plainly than imply a certification we do not hold. When each one is issued, it will be published on this page with its date and scope.
What this means in practice: please do not use Waterfall as a clinical or medical record, and do not send us protected health information until a Business Associate Agreement is signed. If you are a facility evaluating us, talk to us about what your compliance team needs and we will tell you honestly whether we can meet it yet.
What we do today
Consent that can be taken back
Every story carries a consent tier chosen by the person who told it, from platform-only through to attributed. Consent is versioned, and revoking it is not a support ticket: it scrubs the record, deletes any training data derived from it, removes it from search, and writes an audit entry.
Encryption in transit and at rest
Audio, transcripts and account data are encrypted in transit and at rest on Google Cloud infrastructure.
Access limited by role
Who can read a story is enforced by the database itself, not only by the app: the storyteller, people they invited into their circle, and staff at their own facility. Every access path is written down and testable.
An audit trail
Administrative actions and disclosures are logged, so we can answer the question of who saw what and when.
Deletion that means deletion
A person can delete their stories and their account. Derived data, including anything used for training, is removed with it.
What we are working towards
SOC 2 Type II
In progressWe are not SOC 2 certified yet. The programme is underway: policies, access reviews, logging and evidence collection. We will publish the report here when it is issued, and we will not claim it before then.
HIPAA
ScopingWe are working through whether Waterfall should operate as a business associate, and with what safeguards. Until that is settled and a Business Associate Agreement is in place, do not send us protected health information, and do not use Waterfall as a clinical record.
WCAG 2.2 AA accessibility
In progressOur users are old. Accessibility is not a checkbox for us. We are auditing against WCAG 2.2 AA and will publish the results, including what still fails.
Independent penetration test
PlannedScheduled as part of the SOC 2 programme. Results summarised here when complete.
The paperwork
- Privacy policy
- Terms of service, including the pilot terms
- Subprocessors, everyone who touches your data
- Data processing addendum for facilities
- Accessibility statement
- Cookies
Reporting a problem
If you find a security issue, an accessibility barrier, or a story that should not be visible, write to hello@waterfallwisdom.com and put the word urgent in the subject. We will acknowledge inside one business day. We will not take legal action against anyone who reports a vulnerability in good faith and gives us reasonable time to fix it.
This page is maintained by hand and is accurate as of the date of the last deploy. If something here is out of date, tell us and we will correct it.