Waypoint Claims
Trust / Encryption

All of your data, locked under a key only you hold

Every record your organization keeps on Waypoint — claims, notes, documents, reserves, payments, policies, people, phone recordings, your audit trail and every backup — is encrypted under a key held in your own cloud key service account. Waypoint’s software can use it only through a login you create for that one key, and you can end that access in your own console at any moment.

Identity numbers go further still: full Social Security, Medicare, Medicaid and tax numbers live in a separate vault database, also under your key. The claim holds the last four digits only.

Ask how your key connects How it works
The question this answers
If we hold the key, can Waypoint’s staff read our data?
No. Waypoint’s staff have no access to your data, and there is no process for them to ask for it. Your key unlocks your data for the software you use, and only while you allow it. Withdraw it in your own console and within 60 minutes your data is closed to everyone, including us. Waypoint checks your key every few minutes and closes access itself the moment the key is refused.

What is protected, and how

Key, vault, masking
Your Key, In A US Region
Your administrator connects a key from your own key management service. It must sit in a United States region; any other region is refused. Waypoint tests the pair end to end before keeping anything.
Your Own Database, Under Your Key
Your organization has its own database and its own file storage, both locked by your key. Key-service charges arise in your own cloud account.
A Backup Key In Your Account
Onboarding sets up a second key in your own account, so losing one key does not lose your data. Waypoint holds no copy of either key.
A Separate Identity Vault
Full identity numbers live in their own database with their own role and key. Staff see the last four digits; a full number is fetched just in time to build a filing, sent, and flushed.
Who Sees Which Details
A grid of roles against names, addresses, phones, emails, dates of birth and identity numbers. Until changed, only the administrator tier sees full dates of birth and identity numbers.
Credentials Are Never Shown Again
Vendor credentials, your AI key and sign-in secrets are stored encrypted and never returned to a screen once saved. Every earlier credential is kept, never thrown away.
The uncomfortable questions

Answers we give before you ask

These are the questions that separate real encryption from a checkbox. If a vendor cannot answer them specifically, the conversation should continue.

Whose Key?
Yours, in your own cloud account, reached through a login that can use only that key
Can We Revoke It?
Yes, in your own console. Access closes within 60 minutes.
Can Waypoint Staff Read Our Data?
No. There is no access route for Waypoint staff.
Where Are Identity Numbers?
In a separate vault database under its own key; the claim holds the last four only
Can Names Still Be Found?
Yes — protected fields such as license numbers stay searchable by exact match
What If The Key Service Is Down?
Your data is unavailable until it answers. Nothing is read or written in the meantime.
What If We Lose Our Key?
Your backup key opens your data. If both keys are destroyed, the data is gone for good, backups included, so destroying a key comes with a warning and a waiting period.
What Happens When Keys Rotate?
Old keys are kept for as long as any backup or archive made under them exists
Do Phone Numbers Show?
Encrypted under your key; lists show the last four digits, and the whole number only through one audited door
Where we are honest

The limits of encryption

Encryption protects data from the wrong reader. It does nothing about the right reader making the wrong decision.

Not Protection From Authorized Users
Somebody with a legitimate role reads plaintext by design. That risk is managed by the per-role details grid, masking and the audit trail, not by encryption.
Exact Match, Not Fuzzy
Protected fields search by exact match. Where you need loose matching on a protected column, we will tell you that rather than pretending.
A Connect-by Date Applies
Until your organization connects a key, Waypoint shows a banner to your administrators up to the connect-by date it sets.

Read next

Tenant Isolation The two independent walls between organizations. Audit & Retention Personal details are sealed inside the audit trail too. Admin Portal Where your administrator connects the key.

Connect a key with us

Bring the person who runs your cloud account. We will create the key, the one-purpose login and the connection together — and then show you how to switch Waypoint off from your side.

Book a walkthrough Back to the overview