Last updated: Aug 1, 2026
Winza handles participant records, prize/rewards inventory, and brand assets for campaigns that can reach millions of people in a weekend. Security is built into how we design, build, and operate the platform rather than added afterwards. This page describes the controls we run today and how to reach our security team.
Infrastructure and hosting
The platform runs on Railway Web Services in EU regions (Amsterdam, Netherlands) and private data centers in EA regions (Tanzania) across multiple availability zones for resilience. We do not operate our own data centres, and we inherit the physical security, environmental controls, and certifications of our cloud provider. Production infrastructure is defined as code, deployed through peer-reviewed pipelines, and isolated from development and staging environments in separate accounts with no shared credentials.
- Private subnets with no direct inbound internet access to application or database tiers.
- Web application firewall and DDoS protection at the edge via Cloudflare.
- Rate limiting and bot detection on campaign endpoints to prevent entry fraud.
- Immutable, versioned deployment artefacts with the ability to roll back in minutes.
Encryption and data protection
| Layer | Protection |
|---|---|
| Data in transit | TLS 1.2+ enforced everywhere, HSTS, modern cipher suites only |
| Data at rest | AES-256 on all databases, object storage, and backups |
| Secrets | Managed key store with automatic rotation; no secrets in source control |
| Passwords | Hashed with bcrypt and a per-user salt; never stored or logged in plaintext |
| Backups | Encrypted, geographically redundant, with quarterly restore testing |
| Tenant isolation | Row-level scoping enforced in the data layer and verified by automated tests |
Access control
Internal access to production follows least privilege. Every employee authenticates through single sign-on with mandatory multi-factor authentication; there are no shared accounts. Production access is time-bound, requires documented justification, is logged in full, and is reviewed quarterly. Access is revoked within 24 hours of a role change or departure. Customer data is accessed only to deliver support you have requested or to investigate a security incident.
In your own workspace you control access through role-based permissions (owner, admin, editor, analyst, viewer), enforced multi-factor authentication, SAML single sign-on and SCIM provisioning on Enterprise plans, and an audit log of configuration and data changes.
Secure development
- Mandatory peer review on every change before it reaches production.
- Static analysis, dependency scanning, and secret scanning on every pull request.
- Automated test suites gating each deployment, with staged rollouts and fast rollback.
- Annual secure coding training for all engineers, with threat modelling on new features that touch personal data.
- Separate environments; production data is never copied into development or staging.
Monitoring and resilience
We centralise application, infrastructure, and access logs, retain them for 12 months, and alert on anomalous patterns around the clock. Uptime and error budgets are tracked continuously, with an on-call rotation and documented escalation paths. Our disaster recovery plan targets a recovery point objective of 1 hour and a recovery time objective of 4 hours, and is tested at least annually.
Incident response
We maintain a documented incident response plan covering detection, triage, containment, eradication, recovery, and post-incident review. Incidents are severity ranked, and a security team member is on call at all times. Where a confirmed personal data breach affects your data, we notify you without undue delay and within 48 hours of becoming aware, and follow up with a written post-incident report including root cause and the corrective actions taken. Service availability incidents are communicated through our status channel and to your nominated technical contacts.
Responsible disclosure
We welcome reports from security researchers. Email hello@winza.cc with the subject line “Security disclosure”, including steps to reproduce and any supporting evidence. We acknowledge reports within 2 business days and aim to provide a remediation plan within 10 business days.
We will not pursue legal action against researchers who act in good faith: test only against their own account, avoid accessing or modifying other customers’ data, avoid degrading the service, and give us reasonable time to fix an issue before disclosing it publicly. Please do not run automated scanning or denial of service tests against production without prior written authorisation.
Your responsibilities
Security is shared. We ask that you enable multi-factor authentication for every user, review workspace permissions regularly, remove users promptly when they leave, collect only the participant data your campaign genuinely needs, and set retention windows that match your legal obligations. Report anything suspicious in your account to us immediately.
You are also responsible for keeping campaign content within the Acceptable Use limits in our Terms of Service. Content that is unlawful or harmful to participants is a security and trust issue as much as a legal one, and we act on it accordingly. To report an abusive campaign running on Winza, email hello@winza.app.
Contact us
Need a security questionnaire completed, our penetration test summary, or a copy of our audit report? Email hello@winza.cc or write to wiCreate Media Tech, Legal Team, and we will respond within 30 days.
Related documents