Security

• Each firm's data is kept apart

  Global Wakili serves many firms from one platform, so isolation between them is enforced in the data layer on every record, not left to the application screens. Automated tests check that one firm cannot read or write another's data, and they run on every change.

• Encryption

  Data is encrypted at rest using AES-256-GCM and in transit using TLS 1.3.

• A record you can trust

  Critical actions are written to a tamper-evident audit chain using SHA-256 hashing, so any attempt to alter history after the fact can be detected.

• Access by role

  Role-based access control decides what each person in the firm can see and do, down to individual actions, so a junior clerk and a managing partner see different things.

• AI with guardrails

  Sensitive fields are redacted before any call to an external AI service, inputs are screened for prompt-injection attempts, and client data is not used to train AI models.

Security questions from your IT adviser or auditor are welcome. Send them to us and an engineer will answer, or see how we approach data protection for our clients more broadly.