What we actually do, and what we do not claim
A security page is only useful if it is specific. Below is how sessions, access control, metering and payments are handled — followed by the certifications we do not hold, stated plainly.
CasperWasp does not hold SOC 2, ISO 27001 or HIPAA attestation today, and we will not imply otherwise. AI generation is served through third-party model providers, which means your prompt content leaves our infrastructure to reach the model you selected. If your workload cannot allow that, talk to us before you subscribe rather than after.
Eight things that are true today
Each of these is a property of how the platform is built, not a policy we intend to adopt.
Short-lived access tokens
Sessions run on a short-lived bearer token plus an httpOnly refresh cookie the browser cannot read. A refresh rotates the token, and one shared refresh serves every request that hits a 401 at once so a page load cannot invalidate its own session.
Organisation-scoped data access
Every document, PDF, design and ledger entry is keyed to an organisation, and every authenticated request is checked against the caller's membership and role before anything is read.
Roles that gate spending
Owner, admin, editor and viewer are ordered, and billing actions — changing a plan, buying tokens, cancelling — require admin or owner. An editor can create work but cannot spend money.
Rate limiting on the endpoints worth attacking
Registration, login, OTP verification and password reset are limited to twenty attempts per fifteen minutes per client, well above legitimate use and well below useful brute force.
Verified email before an account exists
Registration issues a six-digit code and creates nothing until it is confirmed, so an unverified address never becomes an organisation.
Signed payment webhooks
Gateway callbacks are verified against an HMAC over the exact bytes the gateway signed, parsed from a raw body before any JSON middleware can reshape it.
Full usage audit trail
Each AI call writes an immutable log line — app, tool, model, provider, token counts, cost, duration, outcome — and each wallet movement writes a ledger entry with the balance after it.
Failed work is not billed
Tokens are debited after a successful provider response. A call that errors leaves the wallet where it was, and the failure is still logged so you can see it happened.
Five places, and no others
If a system is not on this list, it does not see your content.
Your browser
01Holds a short-lived access token in memory and localStorage. The refresh token is an httpOnly cookie your JavaScript cannot read.
Our API and database
02Stores your documents, PDFs, extracted text, retrieval indexes, designs, brand kit, wallet balance, usage log and ledger — all keyed to an organisation.
Our file storage
03Holds uploads and generated artwork. Files are served through the API so access is checked against your membership rather than guessed from a URL.
Model providers
04Receive the prompt context of a call you initiated — which may include document or PDF text you asked about. Only what that call needs, only when you run it.
Payment gateway
05Handles card details, which never reach our servers. Its callbacks are verified against an HMAC over the exact bytes it signed.
Reporting something
If you find a vulnerability, email support@casperwasp.com with enough detail to reproduce it. We will acknowledge within two working days and tell you what we are doing about it. Please do not run automated scans against production or test against another customer’s organisation.
Bring the questions before you bring the data
If your workload cannot allow prompt content to reach a third-party model provider, tell us before you subscribe. We would rather lose the sale than have you find out afterwards.
Security questions go to the same inbox as everything else — and get answered by someone who reads the code