Trust
Trust and security
This page states what is true of this website today, where the other commitments are written down, and which public standards WE's research briefs and checklists are written against.
What is true of this website
- Cookies
- None set
- Third-party scripts
- None loaded
- Analytics
- None
- Forms
- Collect only the fields shown
These four statements describe the site you are reading. The privacy notice describes exactly what each form collects and where it goes.
Security and confidentiality in the written agreement
WE does not publish a list of technical controls on this page, and it does not describe a founder’s product as secure. What it does is put security and confidentiality terms in the written agreement for an engagement, where both sides can read them and hold each other to them.
Before you start a readiness review, ask for those terms. Read them against your own needs. If something you need is missing, say so and have your own lawyer check the result.
The same discipline applies to this website. The facts above are things you can check yourself in your browser, and the privacy notice says what each form collects.
Public standards behind WE's briefs
WE's research briefs and checklists are written against the public standards below. They are reference points that anyone can read. Naming a standard is not a statement that WE, or any product built by a founder, has been assessed against it.
| Standard | What it is | Edition | Read |
|---|---|---|---|
| OWASP ASVS OWASP | The Application Security Verification Standard: a set of security requirements for designing, developing and testing web applications and services, organized into three levels. | Version 5.0.0, May 2025 | Publisher page for OWASP ASVS Security baseline brief (OWASP ASVS) |
| NIST SSDF (SP 800-218) NIST | The Secure Software Development Framework: high-level secure software development practices that fit into any development lifecycle, with a common vocabulary. | Version 1.1, February 2022 | Publisher page for NIST SSDF (SP 800-218) Security baseline brief (NIST SSDF (SP 800-218)) |
| AICPA Trust Services Criteria AICPA | Criteria in five categories: Security, Availability, Processing Integrity, Confidentiality and Privacy. SOC 2 reports are attestation engagements by a CPA firm that are built on these criteria. | 2017 criteria, points of focus revised 2022 | Publisher page for AICPA Trust Services Criteria Security baseline brief (AICPA Trust Services Criteria) |
| WCAG 2.2 W3C | The Web Content Accessibility Guidelines: testable success criteria for making web content usable by people with disabilities. | W3C Recommendation, 12 December 2024 | Publisher page for WCAG 2.2 Accessibility brief (WCAG 2.2) |
Read how the standards are used in the SaaS security baseline brief and, for accessibility, the accessibility brief.
What this page does not claim
- It does not say that WE or any product has passed an audit, an attestation or a certification.
- It does not list specific technical controls. Those belong in the written agreement for an engagement.
- It does not describe how any founder company handles its own customers' data. That is each company's responsibility.
Report a concern
Have a question about how WE works with information?
Ask before you start. Security and confidentiality terms are set out in the written agreement for an engagement.