Start with the requirements that could prevent an engagement. Wavect's public Trust Center provides a starting point; project-specific documents and commitments must match your actual scope and data processing.
Useful checks for your shortlist - Legal entity, contracting party and jurisdiction. - Intended services, delivery responsibilities and subcontracting questions. - Rights in bespoke work, third-party licences and account ownership. - Hosting, data locations, access, retention and relevant providers. - Whether an NDA or data-processing agreement is needed before access. - Required insurance, certifications, support coverage and procurement evidence.
The Trust Center states that Wavect does not currently hold ISO 27001 or SOC 2 certification. If either is a mandatory procurement gate, raise it before spending time on detailed scoping. Do not treat engineering practices or a case study as a substitute for a required certification.
Distinguish the providers used by wavect.io from the infrastructure selected for your client project. The website's list is not automatically your project's subprocessor inventory. Confirm project-specific arrangements in the relevant paperwork.
For technical evidence, Cedars describes documentation, review and a scoped assessment. It does not certify Wavect or another customer's compliance. The enterprise pathway shows how procurement and delivery questions connect.
Best first message: send a non-confidential list of mandatory requirements and the review process. Agree a secure channel before exchanging questionnaires containing sensitive information, contracts or access details.