Policies

Security and recovery

Public explanationSign-in not required

Verify this text

Content SHA-256: c0f49f27ae670d5192c4f069b7f026118b5cded510aae1fbfe155681988316af

On this page

Security and recovery

Last updated: October 6, 2026

This page describes how Wavemaker protects accounts and how you can recover access. It is readable without signing in. Changing passwords, sessions or recovery settings still requires your personal account.

How we protect information

  • Passwords are stored only as salted hashes. Wavemaker never stores plaintext passwords.
  • Access tokens are stored as verifiers. Connected provider credentials needed for execution are encrypted at rest and made available only to their selected runtime.
  • Data in transit uses HTTPS/TLS. Data at rest is protected by our infrastructure providers’ encryption.
  • Authentication tokens expire after a limited period.
  • Internal access is restricted. Administrative, technical and organizational safeguards are maintained.

No method of transmission or storage is completely secure. If we become aware of a personal-data breach affecting you, we will notify you and authorities as required by applicable law.

Your responsibilities

  • Keep your password and any recovery material confidential.
  • Use a unique password and a current verified contact address.
  • Sign out on shared devices and review active sessions after unexpected activity.
  • Notify us immediately at [email protected] of actual or suspected unauthorized access.

Workspace memberships do not transfer ownership of another person’s account. A workspace-only credential is not a personal login.

Recovery

If you can still sign in:

  1. Open Security settings
  2. Change your password
  3. Review and revoke sessions you do not recognize
  4. Update verified contact and recovery material

If you cannot sign in, use the sign-in recovery path at Sign in with the verified contact on the account. Recovery codes and password-reset messages are short-lived security mail. They are separate from optional marketing or notification preferences.

Closing an account or workspace is a separate impact-reviewed action. It does not erase records retained for security, payment, moderation or legal obligations. See Export and privacy rights.

Reporting a vulnerability or incident

Email [email protected]. Do not send passwords, session cookies or private media in an unsolicited public report. We do not publish a bounty program or a guaranteed response time on this page.