Security and data

Wiro’s database is a managed PostgreSQL database run by Supabase, hosted on Amazon Web Services in the Asia Pacific (Mumbai) region. Uploaded files are kept in Supabase Storage, and large file transfers in Cloudflare R2.

Data is encrypted in transit with TLS on every connection, between your browser and Wiro and between Wiro and its providers, and encrypted at rest by the database and storage providers.

• Row level security on every table. Records belong to an agency workspace, and access is checked by the database itself, not only by the app.
• Roles and page permissions. Admins decide which pages each team member can open, and removing a member removes their access.
• Server-side privileged access only. Operations that need elevated database access run on the server, never in the browser.

When you connect a mailbox, its password is encrypted with AES-256-GCM before it is stored. Access tokens for connected social media and advertising accounts are encrypted the same way, and are never sent to the browser.

Limited Google access

Connecting Google gives Wiro your email address and access to your calendar, for the Scheduler. Wiro does not request Gmail or Google Drive access and cannot read your email or files. The full list of what each integration can see is in the privacy policy.

Your sign-in

Accounts are verified by email, every API request checks your session on the server, and invite links can only be used once.

• Private files stay private. Expense receipts, email attachments, team chat files and notes media are stored privately and opened through short-lived signed links.
• Client links are unguessable. Report, approval and transfer links use long random tokens, are kept out of search engines, and report links can be refreshed or revoked.

Agency admins can export records such as invoices, expenses and reports. To delete your account and its data, email support@wiro.ae; personal data is deleted within 30 days, except records the law requires us to keep. Wiro does not sell your data, use it for advertising or use it to train AI models.

Please tell us before telling anyone else. Email support@wiro.ae with the details and steps to reproduce it. We’ll acknowledge it, keep you updated while we fix it, and credit you if you’d like. Please don’t access other people’s data, degrade the service or run automated scans against production.