Security

You trust us with the things your kids say. Keeping them safe matters to us as much as keeping them at all.

Who looks after security

Garth Watson, Founder and Security Lead of The Doxa Way Ltd, the company that makes Wamemba me. He is accountable for the security of Wamemba me and of everything The Doxa Way Ltd runs.

The company-wide security policy is at doxa.app/security.

Found a security problem?

Please email garth@doxa.app. Tell us what you found, where, and how we can see it for ourselves. We aim to reply within a few business days.

While you look into it, please:

• give us a reasonable time to fix it before you tell anyone else;
• act in good faith, and go only as far as you need to show us the problem;
• never open, keep or share anyone else’s data, above all anything about a child. If you come across some, stop there and tell us;
• never slow down or break Wamemba me for families, and never try to trick our team or anyone else into giving you access.

We don’t run a bug bounty or pay for reports, but we’re grateful for every one.

How we keep your family’s sayings safe

• Every connection to wamemba.me and to the servers behind the app is encrypted (HTTPS), and browsers are told to use nothing else.
• Every table in our database has row-level security turned on, so the database itself checks who is asking before it hands back a single row.

What we keep, why and for how long is in the privacy policy and our promises.

What this covers

wamemba.me, the Wamemba me apps for iPhone and Android, and the servers and APIs behind them.

Security researchers: our security.txt has the same contact.