Security
How we protect the Enterprise World Model — and everything inside it.
Womo Labs runs inside the customer environment, not ours. This page describes the controls that make that guarantee real.
Sovereign VPC deployment
Womo Labs is deployed inside the customer's own cloud tenant (AWS, Azure, or GCP) as a dedicated single-tenant environment. No shared inference layer, no multi-tenant data plane, no third-party model providers between the customer and their data. Deployments are provisioned via infrastructure-as-code and can be inspected, audited, and revoked at any time.
Zero data egress
Customer signals, entities, and simulation state never leave the customer's VPC. All model calls — including reasoning, causal inference, and simulation — execute inside the customer environment against locally hosted weights. Nothing is sent to Womo Labs infrastructure, foundation-model APIs, or logging services in the clear.
Encryption in transit and at rest
All network traffic uses TLS 1.2 or higher with modern cipher suites. Data at rest is encrypted with AES-256 using cloud-provider KMS keys, with the option to use customer-managed keys (CMK) so the customer holds full cryptographic control. Backups and snapshots inherit the same encryption policy.
Access controls
Role-based access control is enforced end to end. Human access is federated to the customer's identity provider via SAML or OIDC, with support for SSO, MFA, and short-lived credentials. Service-to-service access uses scoped, time-bound tokens. No shared or long-lived operator credentials, ever.
Audit logging
Every read, write, model call, simulation run, and administrative action is captured to an immutable audit log within the customer VPC. Logs stream to the customer's SIEM of choice and are retained per the customer's compliance policy. Womo Labs personnel have no standing access to customer logs.
Responsible disclosure
If you believe you have found a security issue affecting Womo Labs, please contact security@womolabs.ai. We acknowledge reports within one business day and coordinate a fix on a mutually agreed timeline.
For a detailed security package (architecture diagrams, control matrices, penetration test summaries), contact contact@womolabs.ai.