Openwave Trust Centre

Trust, made transparent.

Explore our approach to security, privacy and resilience. Our Information Security Management System is aligned with ISO 27001:2022, SOC 2 and GDPR, while we also align with evolving regulatory requirements, including the EU NIS2 Directive and the Cyber Resilience Act (CRA).

Explore our programme Request documentation

100M+Mailboxes protected

25+ yearsRunning carrier-grade email

ZeroMajor breaches in 25+ years

24x7Security Operations Centre

Standards and frameworks

Certified. Aligned. Accountable.

ISO/IEC 27001:2022CERTIFIED

SOC 2ALIGNED

GDPRREGULATION

OWASP ASVS + Top 10ADOPTED

ISO/IEC 42001ALIGNED

EU AI Act, NIS2, CRAALIGNED

Security programme

Protection at every layer.

Nine domains. One accountable security programme. Select a domain to see how security, privacy and resilience are built in.

Data Privacy

Data protection and privacy

View controls

Privacy GovernanceOpenwave maintains privacy and data protection practices designed to support applicable requirements and responsible handling of personal information.

Data ProtectionPersonal information is protected through appropriate organisational and technical controls throughout its lifecycle.

Privacy RightsWe support applicable data subject rights and maintain processes for handling privacy-related requests.

Secure Software Development Lifecycle

Security built into the development lifecycle

View controls

Secure developmentSecurity is considered throughout the software development lifecycle, with appropriate security review and testing.

Security scanningSource code, open-source dependencies and applications are assessed using security scanning practices.

Independent testingPenetration testing is performed as part of our application security programme, following recognised security testing guidance.

Identity and Access Management

IAM

View controls

Least-privilege AccessAccess to systems and customer data is granted on a least-privilege basis.

Strong AuthenticationMulti-factor authentication and single sign-on protect access to company systems.

Joiners, Movers and LeaversAccess permissions are granted, modified, or revoked in line with employee onboarding, role changes, and offboarding processes.

Infrastructure

Layered infrastructure protection

View controls

Layered controlsOur infrastructure uses layered security controls designed to protect customer data and support service availability.

Endpoint securityCompany devices are centrally managed and protected with industry-leading endpoint security.

EncryptionAppropriate encryption controls are used to protect data in transit and at rest.

Backup and recoveryBackup and recovery practices support the availability and resilience of customer data and services.

Third-Party Risk Management

TPRM

View controls

Supplier due diligenceSuppliers are assessed for security and privacy risk before they are engaged.

Contractual controlsSecurity and data protection requirements are built into supplier agreements.

Ongoing oversightSupplier risk is monitored and reassessed through our risk management process.

Monitoring and Response

Monitoring and incident response

View controls

24x7 SOC monitoringSecurity events are continuously monitored by our 24x7 Security Operations Centre (SOC), which utilises a layered security monitoring and response capability incorporating log analysis, event correlation, threat intelligence, endpoint telemetry, and managed detection and response services to support the timely identification and remediation of security threats.

Endpoint detection and responseEDR is deployed on endpoints to detect, investigate and respond to threats.

Incident responseOur incident response process covers identification, containment, investigation, remediation and closure.

Continual improvementSecurity events and incidents are reviewed to identify improvements to controls and processes.

Vulnerability Management

Vulnerability management

View controls

IdentificationVulnerabilities are identified through security scanning and testing activities.

PrioritisationIdentified issues are assessed and prioritised based on their severity and potential impact.

RemediationSecurity issues are tracked through remediation and appropriate verification activities.

AI Governance

AI governance and responsible AI

View controls

AI in our productsAI used within our products is governed through Openwave policies, defined risk management processes and oversight.

AI use by employeesEmployees may only use approved AI tools, governed by policies that protect customer and company data.

Customer data and AICustomer data is not used to train or develop AI models.

ISO/IEC 42001Our AI management framework is aligned with ISO/IEC 42001 requirements.

Customer Assurance

Policy documentation

View controls

DocumentationRelevant security, privacy and compliance documentation can be requested through our Global Information Security Team.

Available documentsAvailable documentation may include the ISO/IEC 27001:2022 certification, the Openwave ISMS Information Security Policy Documents and the Openwave ISMS Privacy Policy.

QuestionnairesCustomer security questionnaires can be addressed through our established assurance process.

Customer assurance

Openwave Policy Documentation.

Relevant security, privacy and compliance documentation can be requested through our Global Information Security Team.

ISO 27001 certificateON REQUEST

Openwave ISMS Information Security Policy DocumentationON REQUEST

Openwave ISMS Privacy PolicyON REQUEST

Internal ISMS policy covering privacy within our management system. Separate from the public website privacy policy, which covers personal data submitted through our website.

Request documentation

The foundation

Governed. Reviewed. Accountable.

Policy, risk management, control ownership and audit across all nine domains.

Identify

Understand and document our risks and obligations.

Assess

Evaluate risk and the effectiveness of controls.

Treat

Implement and operate appropriate controls.

Review

Monitor, audit and continually improve.

Privacy support

Questions about Privacy?

Our Privacy Team is here to help. Contact us by email at privacyofficer@openwave.ai.

Contact the Privacy Team