Compliance and Security Overview
This Trust Center provides transparent visibility into Mohrer Associates LLC's security, compliance, governance, and trust documentation, giving your procurement and security teams everything they need in one place.
SOC 2 Type 2
SOC 2 Type 1
ISO 27001
GDPR
HIPAA
Third parties that process data on our behalf under strict contractual safeguards.
Google Cloud Platform / Firebase (project table-talk-b87f8, us-central1) is Wave's primary production infrastructure: Firestore stores user, session, transcript, summary and embedding data; Cloud Storage stores audio recordings; Cloud Functions and Cloud Run run the backend; Firebase Auth handles end-user identity. Receives all customer content and account data. Encrypted AES-256 at rest, TLS 1.2+ in transit. Customer Content subprocessor (wave.co/dpa Annex 3).
Vercel
Hosts app.wave.co (Next.js web app), api.wave.co (API and Developer API) and wave.co. Session content (transcripts, summaries, audio uploads) transits its serverless API routes; no primary datastore of customer content. Customer Content subprocessor (wave.co/dpa Annex 3).
Trigger.dev
Background job runner for Wave's processing pipeline (transcription, summarization, email jobs). Job payloads and logs can contain transcript text and session metadata. Customer Content subprocessor (wave.co/dpa Annex 3).
AssemblyAI
Speech-to-text provider. Receives recording audio and returns transcripts with speaker labels. Used via API terms that exclude training on customer data. Customer Content subprocessor (wave.co/dpa Annex 3).
OpenAI
LLM provider for summaries, titles, action items and chat. Receives transcript text and session context, which can contain personal information. Used via API terms that exclude training on customer data. Customer Content subprocessor (wave.co/dpa Annex 3).