Wakemark

Trust

Security & Trust

Last updated: 2026-07-13

Wakemark asks you to bring your provider keys. This is the page that explains why you can trust us to hold them — how custody, isolation, the audit ledger, and provenance actually work. The architecture below is shipped; formal attestations (e.g. SOC 2) are noted as roadmap, never claimed before they are held.

KMS envelope custody

The provider keys you bring are sealed with per-tenant envelope encryption under a managed key-management service (KMS). Wakemark stores ciphertext, never plaintext keys, and keys never appear in logs.

Tenant isolation

Every read and write is scoped to a tenant through invisible tenancy facades (TenantStore / AdminStore). One tenant's keys, jobs, and media are never reachable from another's.

Append-only audit ledger

Every job is event-sourced: append → fold → projection in one transaction. The ledger shows what ran and what it cost — and survives even after content is purged by retention.

Provenance preservation

C2PA content credentials are preserved, detected, and logged (preserve → detect → log), with a sidecar block and a lineage DAG across providers.

Why you can trust us with your keys

Bring-your-own-key only earns trust if the keys are genuinely safe. Under the hood:

  • Keys are envelope-encrypted with a per-tenant data key wrapped by a managed key-management service (KMS) root key. A leak of the database yields ciphertext, not usable keys.
  • Keys are decrypted only in memory at the moment a job is submitted, and are never written to logs (secrets stay out of logs).
  • Per-environment KMS keys mean a non-production leak cannot decrypt production ciphertext.

Isolation & access

Tenancy is enforced in the data layer, not bolted on at the edge. Reads and writes flow through tenant-scoped facades so a query can only ever see its own tenant's rows. Postgres row-level security as defense-in-depth and formal access reviews are on the hardening roadmap.

Audit ledger & retention

The append-only ledger is the audit trail: every submit, attempt, success, failure, and cost is an event. It is designed to support Article 50 workflows — a compliance reviewer can read what ran — and it persists through retention purges, because a minimal usage record survives content deletion. Wakemark does not ensure or guarantee your regulatory compliance; it gives you the trail to demonstrate your own.

Provenance

Outputs are persisted byte-exact and sha256-verified, and C2PA content credentials are preserved and logged. A public verification surface — the human face of the provenance API — is live at /verify: drop an asset or paste its provenance record and check the C2PA status, byte-exact digest, and lineage yourself. See also our writing on provenance and custody.

Reporting a vulnerability

Certifications

We state only what we actually hold. SOC 2 Type II is on our roadmap, not a current attestation — and we will claim a certification only once it is genuinely in place, never before. For the contractual security commitments, see the DPA; for who processes what, the subprocessor list.