You set the guardrails. Your agents work within them.
Wellsite protects operating data with server-enforced access controls, database-level isolation, bounded agent authority, and auditable actions.
Your company’s data stays in your company.
Wellsite enforces organization access on the server and again in the database. Customer tables use forced row-level security, and automated isolation tests run in CI to check that one company cannot read or write another company’s data.
Database-enforced isolation
Customer data is filtered by organization at the database layer on every query. The application database role cannot bypass those row-level security policies.
Scoped collaboration
Service providers and other outside participants see only the wells and records shared through their project or grant—not the operator’s entire organization.
Private file access
Customer files are stored privately. Download links are issued only after an access check and expire after five minutes.
Server-side authorization
Permissions are enforced by the API, not by what the browser or mobile app chooses to display.
Agents work within the guardrails you set.
Each agent has its own identity inside one organization. Agent actions are refused by default unless Wellsite explicitly permits them, and only organization administrators can configure agent authority.
Human approval stays human
Agents cannot approve their own requests. When an action requires approval, only a person can make that decision.
Some actions stay off-limits
Agents cannot sign or submit filings, move money, grant standing access, make or accept offers, place orders, cancel tasks, waive reports, or commit above their authorized ceiling.
Zero-dollar default
New agents start with no authority to commit money. Anything above the configured limit requires a person’s approval.
Admins control the team
Agents cannot change their own permissions or limits. Organization administrators configure them and can switch the agent team off.
Actions leave a record.
Wellsite maintains an append-only activity log that the application cannot edit or delete. Events identify whether the actor was a person, an agent, a provider, or the system.
Agent evaluations also have their own immutable decision log, preserving a record of agent activity even when an evaluation results in no action.
Protected in AWS.
Encrypted at rest
Wellsite’s production database, database backups, customer file storage, server disks, and container images are encrypted at rest.
Encrypted public connections
The application, API, AI connector, and marketing site use HTTPS. Customer file storage refuses unencrypted connections.
Resilient database
The production database uses Multi-AZ deployment, deletion protection, and point-in-time recovery for the previous seven days.
US infrastructure
Core servers, database, and file storage run in AWS us-east-1. AI model calls use Amazon Bedrock and may be processed in other AWS regions within the United States.
Customer operating data is not used to train models today.
Wellsite’s current product does not have a model-training pipeline. Training eligibility is off by default and can only be enabled by an organization administrator.
AI model calls are made through Amazon Bedrock in AWS US regions. Glasses recordings that require cloud transcription are processed with Amazon Transcribe in us-east-1.
Controls are checked continuously.
Isolation tests
Automated tests exercise cross-organization read and write boundaries on every change.
Code security scanning
CodeQL scans application code for vulnerabilities on pull requests, pushes, and a weekly schedule.
Release vulnerability gate
Container images are scanned, and releases stop automatically when an unapproved critical vulnerability is found.
AWS monitoring
AWS account activity is recorded and monitored with CloudTrail, AWS Config, GuardDuty, Security Hub, and Access Analyzer.
Specific about where we are today.
Wellsite does not currently hold a SOC 2 or ISO 27001 attestation. We would rather state the controls that are implemented today than claim certifications we do not have.
Security is an operating discipline, not a badge. We continue to harden access, infrastructure, agent credentials, backups, and security processes as the platform grows.
Operational context, not surveillance.
Wellsite recognizes authorized operational locations and uses authorized evidence relevant to the work. Entering a Wellsite location establishes Field Visit context; it does not make every piece of personal media operational data.
Wellsite doesn't record your day. It understands your work.