Trust

The controls that protect a business's facts, the suppliers who process data, and where each one sits.

Controls

Twelve controls, the status of each, what implements it and the evidence it leaves behind. Evidence is the point. A control nobody can produce a record for is a claim.

Built means the code runs the control today. Partial means part of it is in the code and the rest is named. Planned means nothing is in the code yet.

Control	Status	What it is	Evidence
Domain ownership	Partial	A hostname is served only after its records resolve. Pending and paused hostnames are checked every five minutes and verified ones daily, and a hostname is paused the moment its ownership record stops resolving. The code is deployed. The live proof on a test domain waits on the edge provider's account settings.	The receipts on the organisation, one per check, with the result and what the edge did.
No cross-tenant serving	Built	Each account gets its own routing target, and the dispatcher serves only from bindings that already verified. No path runs from one account's hostname to another account's data.	The routing derivation test, run in the release gate.
Tenant isolation	Built	One isolate per account at the edge, forced row-level security in both planes and on the tenant tables of the control plane, and a single access path that opens a connection inside an account context. The Workers connect as a login role that is a member of the application role, never as the table owner.	Isolation tests, the row-level security proof that runs in the build, and the deploy's check that the login role cannot bypass it.
Signing keys	Built	Keys are generated out of band and provisioned into the edge provider's secrets store, bound read-only to the signer for their plane. The private halves are reachable only over a service binding, and a revoked key signs nothing more from the moment the store says so.	The key inventory, and the revocation drill in the runbooks.
Change control	Built	Every change to control plane data is written as a receipt in the record grammar, with who, what and when.	Receipts, exportable by account.
Access control	Partial	Roles with least privilege and support grants that expire are in the schema. End dates on partner access and the step-up check before anything sensitive are in the dashboard's current work.	The access review export and the operator action log, both planned.
Transport and storage	Built	A certificate per hostname at the edge, encryption at rest on both database planes, and every secret held in the secrets manager rather than in code.	The certificate inventory, and the secret scan results from every run.
Incident and availability	Partial	An incident runbook that commits to notice within twenty four hours, and a documented exit for each level. The status page is planned.	The runbook, and the status history once the page exists.
Sub-processors	Built	Six named suppliers, listed with what each one receives from the code as it is.	The list above, published here and reviewed quarterly.
Where data lives	Partial	Every account carries a region, and routing holds one row for it. The alarm on a request that resolves across regions is planned.	The region column on every account. The alarm configuration, once it exists.
Secrets	Built	One machine identity for the deploy, authenticated from the build with a short-lived token rather than a stored key, and trusted only from a push to the develop branch or a job in the production environment. A pull request's workflow reads nothing, and a preview mints its own two secrets. The Workers read bindings and never call the secrets manager.	The secrets manager audit log, and the scan results from every run.
Key custody	Built	One signer per plane. Only the public halves are published in the directory.	The key inventory, with region and rotation dates.

Suppliers

Six suppliers process data on Welila's behalf. Each row says what that supplier actually sees. Anything not on this list receives no customer data.

Supplier	What it sees	Where
Cloudflare	Every request to every Welila surface, and the page bytes served back. It runs the site, the dashboard, the API, the dispatcher and the reader as compute, and holds the signing keys in its secrets store, bound read-only to the signer.	A global network. Data, keys and logs are pinned to region; compute runs where the request lands.
Neon	All stored customer data. The control plane holds organisations, routing, hostnames, domain checks, payment event ids and the public directory. The identity databases hold people: credentials, sessions and invitations. The plane databases hold memberships, facts, sources, reads, claims, journeys and records.	The control plane and the European plane in London. A United States plane in Virginia from the first claim there.
Infisical	Secrets only, never customer data. It holds the session secret, the routing pepper and the supplier keys, and hands them to the deploy, which writes each onto its Worker. The database connection strings are resolved from Neon at deploy and are not stored here.	A European cloud.
Stripe	Payment data for a paying account: the buyer's name, email address, billing address, card details and the tax position for the sale, which Welila never holds itself.	A United Kingdom entity, processing globally.
Resend	Outbound email: the recipient address, the subject and the body of every message Welila sends, and the delivery result.	A European region on the sending domain.
Anthropic	The text of a source page the reader fetched, sent for fact extraction, and the text of a question a caller asked of a journey, sent with the business's confirmed facts to answer it. It does not receive account records, contact details or payment data.	United States processing over the standard messages interface with an API key, which carries no retention setting. The account's retention setting has not been read from the console, so this row makes no retention claim until it has.

Certification

Welila is not certified yet. These controls are implemented, the evidence is listed, and no third party has reviewed it. The audit is scheduled at incorporation. Every supplier's own certifications are theirs, held on their own trust page.

Where data lives

The control plane and the European plane are in London. A United States plane in Virginia opens with the first claim there. A person's identity stays in their region, and a business's facts stay in the region of the business.