Security claims,
kept evidence-bound.
This page is a bounded summary of approved security evidence for Streamwake. It is not a certification, audit report, service-level commitment, deployment-option statement, or exhaustive provider register. Send unanswered questions to the public contact form.
What the evidence covers today.
These areas are within the approved scope for this page. They are described narrowly and do not imply coverage for unlisted capabilities.
Content security and framing
The reviewed web boundary covers content-security policy and framing restrictions designed to reduce script injection, click-jacking, and form-redirection exposure.
Encryption boundaries
The reviewed evidence covers encryption in transit and managed database encryption at rest. This page does not extend that statement into a broader deployment or infrastructure assurance.
Sessions and outbound request checks
The reviewed control area includes session handling and SSRF checks for outbound probe requests. It is not a claim about service availability or a response-time commitment.
AI processing boundary
The reviewed scope includes the configured AI processing boundary. The public page makes no provider-specific retention, training, or residency assurance beyond approved evidence.
Hosted payment boundary
Checkout uses a hosted payment flow; Streamwake does not collect card numbers in its own interface.
Evaluation status stays explicit.
Topics marked IN EVAL are bounded by a named scenario and its evidence conditions. They are not presented as generally available product commitments.
SSO / SAML and domain routing
SSO/SAML and domain-routing behavior may be discussed with a reviewer only within the agreed evaluation scope. This page does not present them as generally available or as a deployment commitment.
Organization roles
Organization-scoped roles are evaluated against the stated customer scenario and evidence conditions. This label is not a blanket production-readiness claim.
Precise scope, no extrapolation.
The public page separates reviewed boundaries from questions that require a direct evidence exchange.
Account and operational data
The reviewed scope covers account, organization, session, stream, and probe metadata as product data categories. Specific lifecycle, storage-location, and provider terms are not stated here without matching evidence.
Questions outside the register
Requests for detailed contractual, operational, or provider evidence should be sent to the security contact. We will distinguish available evidence from items that remain under evaluation.
Control coverage, not a status note.
Framework language provides review context only. It does not convert local implementation context into deployment evidence or an attestation.
Framework context, not certification
The reviewed control areas can be discussed against SOC2 Trust Services Criteria and ISO 27001 control themes. A framework mapping is not certification or third-party audit evidence.
- SOC2 Trust Services Criteria·Review context
- ISO 27001·Review context
No third-party attestation is published
No SOC2 Type I, SOC2 Type II, ISO 27001 certification, or equivalent third-party audit report is currently issued for the platform.
- SOC2 Trust Services Criteria·Status note
- ISO 27001·Status note
A clear contact path, without invented timing.
The public wording stays aligned with applicable requirements and the evidence currently approved for publication.
The questions
procurement teams send us.
Quick answers to the questions covered by the public evidence scope. Anything more specific goes to the public contact form.
Tell us what the
security team wants to see.
Send any open questions and we'll separate approved evidence from evaluation items.