We look after your devices. Here's how we look after your data.
Wardlark holds sensitive things, like the keys that unlock your laptops. This page says where your data lives, who can see it, and how we protect it.
Hosted in London
The Wardlark service and its databases run on Google Cloud in the London region (europe-west2). Your device data, policies and recovery keys stay in the UK.
Recovery keys, locked away
FileVault and BitLocker recovery keys are envelope-encrypted: each key is sealed with a data key, which is sealed again by Google Cloud KMS with a key for your organisation alone. They're never written to logs.
Every reveal recorded
Admins must sign in again before revealing a recovery key. Every reveal, lock and wipe is written to your audit log, with who did it and when.
Organisations kept apart
Every record carries your organisation's ID, and the database enforces it with row-level security as a second line of defence.
Strong admin sign-in
Every admin uses a second factor: an authenticator app or a passkey. Google and Microsoft sign-in are available on the Business plan.
Careful with wipes
Wiping a device needs you to type its name first. We never wipe automatically, even when a device falls out of policy.
Subprocessors
These companies process customer data on our behalf. We'll update this list, and tell customers, before adding anyone new.
Draft list.We're confirming the final providers and their data locations before launch.
| Company | What for | Where |
|---|---|---|
| Google Cloud | Hosting, databases, encryption keys (Cloud KMS) and backups for the Wardlark service | London, UK (europe-west2) |
| Postmark | Sending emails: sign-in codes, alerts and daily summaries | United States |
| Stripe | Taking card payments and sending invoices | United States and Ireland |
| Slack | Delivering alerts, only if you connect a Slack channel | United States |
Devices also talk to Apple and Microsoft directly: Apple's push service wakes Macs, iPhones and iPads so they check in. Those messages carry no personal data, only a device token.
What's next
- An independent penetration test before general availability.
- Cyber Essentials Plus for Wardlark itself.
- SOC 2 or ISO 27001 as we grow.
Found a security problem?
Please email security@wardlark.com. We'll reply within two working days and keep you posted while we fix it.