---
title: Trust
description: The controls, the suppliers and where the data lives.
canonical: https://welila.com/trust
---

# Trust

The controls that protect a business's facts, the suppliers who process data, and where each one sits.

## Controls

Twelve controls, what implements each and the evidence it leaves behind. Evidence is the point: a control nobody can produce a record for is a claim.

| Control | What it is | Evidence |
| --- | --- | --- |
| Domain ownership | A hostname is served only after its ownership check passes. The check re-runs daily and the hostname is paused the moment it stops passing. | A verification log per hostname, with every check and its result. |
| No cross-tenant serving | Each account gets its own routing target, and the dispatcher serves only from bindings that already verified. | The routing derivation test, run in the release gate. |
| Tenant isolation | One isolate per account at the edge, forced row-level security in both planes, and a single access path that opens a connection inside an account context. | Isolation tests, and the row-level security proof that runs in the build. |
| Signing keys | Keys are generated inside the signing service for their plane. The private halves live in that service's secret store and are reachable only over a binding. | The key inventory, and the revocation drill in the runbooks. |
| Change control | Every change to control plane data is written as a receipt in the record grammar, with who, what and when. | Receipts, exportable by account. |
| Access control | Roles with least privilege, end dates on partner access, support grants that expire, and a step-up check before anything sensitive. | The access review export, and the operator action log. |
| Transport and storage | A certificate per hostname at the edge, encryption at rest on both database planes, and every secret held in the secrets manager rather than in code. | The certificate inventory, and the secret scan results from every run. |
| Incident and availability | A status page, an incident runbook that commits to notice within twenty four hours, and a documented exit for each severity level. | The runbook, and the status history. |
| Sub-processors | Six named suppliers, listed with what each one sees. | The list above, published here and reviewed quarterly. |
| Where data lives | Every account carries a region. Routing holds one row for it, and an alarm fires if a request ever resolves across regions. | The region column on every account, and the alarm configuration. |
| Secrets | One machine identity per service and region, authenticated from the build with a short-lived token rather than a stored key, and a rotation calendar. | The secrets manager audit log, and the scan results. |
| Key custody | One signer per plane. Only the public halves are published in the directory. | The key inventory, with region and rotation dates. |

## Suppliers

Six suppliers process data on Welila's behalf. Each row says what that supplier actually sees. Anything not on this list receives no customer data.

| Supplier | What it sees | Where |
| --- | --- | --- |
| Cloudflare | Every request to every Welila surface, and the page bytes served back. It runs the site, the dashboard, the API and the reader as compute. | A global network, with compute pinned to Europe. |
| Neon | All stored customer data. The control plane holds accounts, hostnames and the directory. The plane databases hold facts, sources, records and logs. | The control plane and the European plane in London. A United States plane in Virginia from the first claim there. |
| Infisical | Secrets only, never customer data. It holds the connection strings and the supplier keys, and hands them to a service at deploy. | A European cloud. |
| Stripe | Payment data for a paying account: the buyer's name, email address, billing address and card details, which Welila never holds itself. | A United Kingdom entity, processing globally. |
| Resend | Outbound email: the recipient address, the subject and the body of every message Welila sends, and the delivery result. | A European region on the sending domain. |
| Anthropic | The text of a source page the reader fetched, sent for fact extraction. It does not receive account records, contact details or payment data. | United States processing, on the zero retention terms of the interface used. |

## Certification

Welila is not certified yet. These controls are implemented, the evidence is listed, and no third party has reviewed it. The audit is scheduled at incorporation. Every supplier's own certifications are theirs, held on their own trust page.

## Where data lives

The control plane and the European plane are in London. A United States plane in Virginia opens with the first claim there. A person's identity stays in their region, a business's facts stay in the region of the business, and an alarm fires if a request ever resolves across regions.