A platform that holds your admin access must be exemplary
Wabba-Sego drives your security devices: that makes it a prime target. Security guides how it is designed, how it is delivered and how we work.
How the product is secured
On your premises, offline
No dependency on the internet or a third-party service: your data and your access stay with you.
Signed releases
Every release is signed; its SHA-256 checksums and signature are checked before installation.
No write outside a plan
Dry run, approval if enabled, ordered application, logging: no exceptions, no workaround.
Encrypted secrets
PCE credentials encrypted with AES-256-GCM by a master key kept outside the database; never displayed or logged.
Protected access
Two-factor authentication, built-in or custom roles, rights checked on the server, data kept apart per tenant.
Traceability
An audit log that cannot be modified, and an exchange log with every device, with no secrets.
Hardened containers
No privileges or root account, read-only file system, images scanned before every release, SBOM supplied.
Backups
Every night and before every update; restore tested with every release.
Verify a release before installing it
The files of a release (bundle, virtual appliances) come with their checksums SHA256SUMS, their signature SHA256SUMS.sig and the public signing key. Check them on a Linux machine before opening anything:
Signing key fingerprint
E03A 2428 F72F F058 6459 C92D 3EA6 AED3 99EF 4C68
Compare this fingerprint with the one you received through another channel (guide handed over, telephone). If it differs, go no further and tell us.
gpg --show-keys wabba-sego-signature.asc
gpg --dearmor < wabba-sego-signature.asc > wabba-sego-signature.gpg
gpgv --keyring ./wabba-sego-signature.gpg SHA256SUMS.sig SHA256SUMS
sha256sum --check --ignore-missing SHA256SUMSReport a vulnerability
Do you think you have found a vulnerability in Wabba-Sego, on this site or on the portal? Write to us following our coordinated disclosure policy. We acknowledge receipt within three business days and keep you informed until it is fixed.
Cyber Resilience Act
Regulation (EU) 2024/2847 on cyber resilience requires manufacturers of products with digital elements to handle their vulnerabilities throughout the product's life. Since 11 September 2026, actively exploited vulnerabilities and severe incidents must be reported; the other obligations apply from 11 December 2027. We are getting ready: coordinated disclosure, published security advisories, security updates and a software bill of materials (SBOM) supplied with every release.
This site and the customer portal
- No trackers: no audience measurement, advertising or social networks; only the technical cookies that are strictly necessary.
- Fonts and icons are hosted here: nothing is loaded from another site.
- The portal is protected by two-factor authentication, mandatory for our team and optional for each organisation to require.
- Files exchanged are stored outside the public web and released only after rights are checked.
Try Wabba-Sego on your infrastructure
- Demonstration
On your use cases, with your conventions.
- 90-day pilot
Installed on your premises, offline, connected to your PCE: a pilot on a real scope.
- Pilot review
From the labelling model to enforcement: objectives set at the start, measured at the end.