Trust Center
How we earn your trust, continuously, not annually.
You’re asking us to protect your Microsoft 365 tenant, your compliance posture, and your audit evidence. This page shows exactly how we hold ourselves to the same standard we hold your environment to, the attestations we carry, the baseline we run on ourselves, and the upstream certifications we inherit.
Our own tenant, right now WaypointX
80%
987 of 1235 points
Mark is 998.8 pts, where this stood 30 days ago. Gain -11.8 pts.
Where this number comes from
-
01
Microsoft scores the tenant
21 OCT 2026 00:00Z
Secure Score is Microsoft’s measurement of our own tenant, not ours. We do not compute it and we cannot adjust it.
-
02
WaypointX publishes it
21 OCT 2026 05:59Z
Our own product reads the tenant and writes a signed posture object to a public endpoint. The same job runs for clients.
-
03
This page reads the feed
21 OCT 2026 07:58Z
This site holds no tenant credential. It reads the published object on a schedule and prints only what it read.
The freshness rule this page holds itself to
A reading under 72 hours old is published as live. Between 72 hours and 7 days it is published and labelled stale. Past 7 days it is not published at all, and this page says there is no current reading rather than showing you the last good one. The marker above is where this page sits right now.
Why the rule is published
Every trust page claims to be current. None of them say what current means, which makes the claim unfalsifiable and therefore worthless. Ours is a number, with a threshold, and a marker showing where we are against it. If we drift past it, this page will tell you before you have to ask.
The tenant
We run WaypointX on ourselves
The baseline we deploy for clients is the baseline enforced on our own Microsoft 365 tenant. Drift is monitored continuously across all six coverage domains, the same dashboard view our clients see on their tenants.
The two right-hand columns say different things on purpose. The middle column is configuration: the control is on, and drift against it is watched. The right column is Microsoft’s own measurement of an entire Secure Score category, most of which is outside our baseline. A domain can be correctly enforced and still sit inside a category that scores low, and a page that hid that distinction behind one green tick would be doing the thing this page exists to argue against.
If anything on our tenant ever goes amber or red, it shows up here within 24 hours. We don’t hide behind static badges, continuous verification is the whole point.
The record
Our attestations and commitments
Independent programs we’ve enrolled in or publicly self-attested to. Each badge below links to the issuing authority so you can verify directly, we don’t ask you to take our word for it.
Microsoft Cloud Partner
Registered partner in the Microsoft Cloud Partner Program. Listed in Microsoft’s partner directory with Solutions Partner designations in progress.
CISA Secure by Design Pledge
Voluntary pledge to CISA’s secure-by-default principles, MFA-by-default, least privilege, and transparent vulnerability disclosure.
Cyber Readiness Certified
Cyber Readiness Institute’s structured program covering identity, device, data protection, and supply chain hygiene.
NIST Cybersecurity Framework
Public self-attestation mapping Waypoint’s internal controls to the NIST CSF functions, identify, protect, detect, respond, recover.
SOC 2 Type II
Not held today. On the roadmap, and it will appear in this register when it is real.
ISO 27001
Not held today. On the roadmap, and it will appear in this register when it is real.
Honesty note
- We don’t list certifications we don’t hold.
SOC 2 and ISO 27001 are on our roadmap, we’ll publish them here when they’re real, not before.
Inherited, not ours
Upstream trust, the certifications we inherit
Client data is processed and stored inside Microsoft 365, in your own tenant, not ours. As a downstream processor, we inherit Microsoft’s enterprise certifications. You can verify any of these directly at the Microsoft Service Trust Portal.
Microsoft Service Trust Portal- SOC 2 Type II Microsoft 365 & Azure
- ISO 27001 Microsoft 365 & Azure
- FedRAMP High Microsoft 365 GCC
- HIPAA BAA Microsoft 365
- Held by Microsoft Corporation
Handling
How we handle your data
- Data residency
- Your data stays in your own Microsoft 365 tenant. We access it via delegated Graph SDK permissions, never replicated, never stored outside your environment.
- Least privilege access
- Scoped Graph SDK permissions reviewed quarterly. No Global Admin rights unless explicitly granted for a defined deployment window, then revoked.
- Incident response
- 72-hour breach notification to all affected clients. Documented runbook, tested annually. Direct escalation to miguel.e@wpta.io or security@wpta.io.
- Internal access & audit
- Every staff action against a client tenant is logged to the Microsoft Unified Audit Log. You can request your tenant’s full Waypoint access log at any time.
The log, drawn. Six lanes, one per coverage domain, running left to right through time. Every tick is a check. The solid runs are drift the check found, and the green stroke after each one is the correction. A picture of the process and not a plot of figures: there are no real numbers in this drawing, and inventing some on this page would be the one unforgivable thing.
Subprocessors
Subprocessors
The short list of third parties that may process client data on our behalf. If this list changes, we update this page and notify active clients before the change takes effect.
| Subprocessor | Purpose | Data processed | Region |
|---|---|---|---|
| Microsoft | M365 & Azure hosting | All client data | United States |
| Anthropic | aICISO AI briefings (opt-in) | Risk metadata, no PII | United States |
Full subprocessor disclosure, including audit reports, available under NDA on request.
Documents
Documents & policies
- WaypointX Security Whitepaper Baseline architecture & controls On request
- Privacy Policy How we collect & use data Web
- Mutual NDA (blank) Fill in, sign, return On request
- Data Processing Addendum CCPA & GDPR ready On request
- Security Questionnaire (SIG Lite) Pre-filled, updated quarterly On request
- NIST CSF Self-Attestation Mapped to WaypointX domains On request
Documents not published here are sent directly. Ask and they arrive the same day.
Disclosure
Found something? Tell us.
If you believe you’ve discovered a security vulnerability in any Waypoint Tech Advisors product or service, please email security@wpta.io. We respond within one business day and credit responsible disclosure in our release notes.
For non-security inquiries: miguel.e@wpta.io · Booking: outlook.office.com/book/InitialConversation