Getting things ready…
This document covers the Wave Ride platform hosted atwaveride.aiand the mobile apps distributed under the Wave Ride iOS and Android bundles. Audience: security, compliance, and procurement reviewers evaluating Wave for production use.
Where this document says documented we mean it ships in code today. Where it says in progress we mean it's actively underway — we'll name an expected date and not slip it by more than a quarter.
Secure-by-default route allow-list — routes that aren't explicitly public require authentication. This prevents a developer from introducing an open admin route by forgetting to add a guard.
Consumer PII (name, phone, email, saved addresses) is scoped to the tenant that owns it. Location data is kept only for the trip duration on rider surfaces; driver location history is retained for ops review and automatically truncated.
Stripe handles all card data. Wave is PCI SAQ-A — card PANs never reach our servers. Exported logs are PII-masked unless the exporting admin explicitly toggles full disclosure (which is itself audit-logged).
Evidence collection underway via automated monitoring. Target: 2026 Q3. Bridge letter available on request.
Airport TNC regulatory reporting integrated. ENTRY / EXIT / PICK-UP / DROP-OFF emitted per participating airport.
Payments tokenized via Stripe Elements. Raw card PANs never transmitted or stored by Wave.
Wave operates under a BAA for healthcare tenants. BAA signing is Enterprise onboarding scope.
Wheelchair-accessible vehicles are a first-class rider preference and driver certification.
On-call rotation. Slack-alerted anomalies via alert-service with retry + failed-alerts Firestore logging. Post-incident reviews shared with affected tenants within 72 hours. Customer-facing status page at status.waveride.ai (coming soon).
For good-faith security research, contact security@waveride.ai. We acknowledge within one business day and credit responsible disclosures.