Trust and Security

ISO 27001:2022 certification

Wave Systems and its parent company, Complexica, are certified as meeting ISO 27001:2022, the internationally recognised standard for information security management systems. Complexica’s recertification to the 2022 version of the standard was announced in June 2023, following an extensive audit by TQCSI International, an accredited, third-party certification body.

The certification details are publicly available in the TQCSI certificate directory, and the TQCSI certification mark appears in the footer of every page on this site.

Information security policy

Complexica’s Information Security Policy sets out the principles behind the certified information security management system. Its core principle is to ensure the confidentiality, integrity and availability of the information entrusted by customers and business partners, whether in storage, processing or transmission. Its objectives include:

• a culture of security awareness, in which everyone has responsibility and accountability for protecting information
• effective security controls for the confidentiality, integrity and availability of information
• an information security management system operated in accordance with ISO/IEC 27001, with continual improvement
• monitoring systems and investigating all detected security breaches and weaknesses
• identifying and managing information security risks in line with a risk management framework

Application support and information security are led by Harish Rao, Chief Information & Security Officer. See the Team page.

Deployment and data

• WaveSCM is available as SaaS (cloud hosted) or on-premise, so each organisation can choose the deployment option that best suits its requirements.
• WaveSCM Decision Cloud^® can be hosted and run by Wave Systems, or deployed into your own private cloud where data residency or internal policy requires it. Each customer runs in a separate environment with its own credentials and model endpoint.
• Decision Cloud modules propose and explain, and a person accepts the outcome. The reasoning behind each recommendation is visible, what was suggested stays on the record, and higher levels of automation are introduced only where you ask for them.
• Integrations with third-party systems can use modern APIs and web services over secure HTTPS / OAuth. See System Integrations.

For questions about hosting, data location or our security controls, please contact us.

Privacy

How we handle personal information submitted through this website is set out in our Privacy Notice.