Security
How we look after your data
Your customers trust you with their details. Here's exactly how we protect them, without vague reassurances, and with no certifications we don't actually hold.
Encryption in transit and at rest
Every connection to your site and dashboard is encrypted (TLS, via Let's Encrypt certificates on our hosting stack). The contact details you and your customers give us -- names, emails and phone numbers -- are encrypted at rest with AES-256-GCM, a standard that also detects tampering, not just scrambles the data.
Hosted in the EU
Your site and its database run on Hetzner infrastructure in the European Union (Germany) -- not shipped to a data centre outside the EU as a matter of course.
Every upload is verified, scanned, and re-encoded
Every file uploaded through your site passes three independent checks before it is stored: its real file type is verified by inspecting its bytes, it is scanned for malware by a live scanner that rejects uploads outright if scanning is ever unavailable, and images are re-encoded to strip anything hiding inside them. Files are then stored in EU data centres.
Who we share data with
Named plainly, not hidden behind a generic 'third-party services' line. Two are load-bearing for every business; two only apply if your plan uses them.
| Provider | Purpose | Location | When |
|---|---|---|---|
| Hetzner Online GmbH | Website hosting, object storage, and application infrastructure | European Union (Germany) | Every plan |
| Zoho ZeptoMail | Transactional email delivery | European Union | Every plan |
| Zoho Corporation (Zoho Campaigns Email API) | Delivery of email campaigns to customers who agreed to receive them | European Union | Only if your plan uses that feature |
| WhatsApp Business Platform (Meta Platforms Ireland Limited) | Sending and receiving WhatsApp messages about your bookings, orders, and enquiries | European Union / United States (standard contractual clauses) | Only if your plan uses that feature |
| Stripe | Payment processing for online orders, bookings, and membership billing | European Union / United States (standard contractual clauses) | Only if your plan uses that feature |
We don't sell your data, or your customers' data, to anyone.
GDPR: what's self-service today, and what isn't yet
If you sell online, your shop customers get real, built-in self-service pages to access their own data or request account deletion, on every site with online ordering. This isn't a form that emails a person and waits -- it's a working feature.
For other contacts, bookings, enquiries and memberships, that same self-service isn't built yet. Today we handle those requests directly when a customer emails us, and we're building the same self-service mechanism out to cover them too.
Every site on the platform ships with a real Privacy Policy and Terms of Service generated from your actual business details, not placeholder legal text left over from a template.
Data processing agreement
As the business using WrenSync, you're the data controller for your own customers' data, and we act as your processor. Our Data Processing Agreement sets out exactly how, and applies automatically to every account.
Have a specific security question?
Ask us directly, before you sign up. We'd rather answer it now than have you find out later.
Contact sales