How Wonlex and SETracker Address Data Security Questions from Global Customers

These are important questions for any connected device provider. Below, we share our responses to common data security questions from global customers and partners, covering Wonlex smartwatch applications and the SETracker platform — from data storage and encryption to access controls and ongoing security practices.

Q1: Please describe the key security controls currently implemented, including, where applicable, data-in-transit encryption, user authentication and authorization, API security measures, and access controls for stored or processed data.

Data Transmission Security:

All communications between the App, devices, and servers are protected using HTTPS (TLS) encryption. Mutual certificate authentication (mTLS) and AES-256 encryption are applied to ensure secure data transmission.

User Authentication and Authorization:

User access is authenticated through account and password verification, with support for Google Sign-In SDK integration. All App features require users to complete authentication before access is granted.

API Security:

All API endpoints are protected via HTTPS and TLS with mutual TLS (mTLS). Unauthorized requests are blocked from accessing any API resources.

Access Control for Stored and Processed Data:

The server-side system implements Role-Based Access Control (RBAC). Only authorized personnel with valid credentials can access stored data. User data is logically isolated by account, preventing unauthorized access between different users.

 

Q2: Where are the servers hosting the application and related services located, and where is the data processed? Please specify the country/region and the infrastructure or cloud service provider, if applicable.

All application hosting and data processing runs on Amazon Web Services (AWS) infrastructure located in Frankfurt, Germany. No data processing takes place outside this region.

 

Q3: Is any personal or device-related data processed, stored, or transferred outside the EU/EEA? If yes, please specify the relevant countries/regions and briefly describe the transfer mechanism or safeguards applied.

The majority of personal and device-related data is processed and stored on AWS servers located in Frankfurt, Germany, within the EU/EEA. Data stored on European servers includes:

• App account nickname data
• Device location (GPS) data
• Location history/tracking data
• Phone book and contact data
• Call record data

However, certain data is transferred to third-party SDK providers outside the EU/EEA:

Google Maps SDK: Location data is transferred to Google for map and location-related services.
Juphoon System Software Co., Ltd. SDK: IMEI data and voice/video data are transferred to Juphoon's servers located in Singapore.

Data stored on European AWS servers is not further transferred to backup systems, subcontractors, or other cloud providers in additional countries.

 

Q4: Please describe how access to sensitive device functions is secured, particularly GPS/location services, microphone access, and camera access. Please include details on authentication, authorization, permission management, and access restrictions.

GPS / Location Data:

• Accessed through the Google Maps SDK.
• Requires explicit user permission granted through the mobile operating system (Android/iOS).
• Location data is used for real-time device tracking and is transmitted using HTTPS + TLS + AES-256 encryption.

Microphone Access:

• Used for voice calls through the Juphoon SDK.
• Requires explicit permission granted at the operating system level.
• Voice data is transmitted in real time only and is neither recorded nor stored.

Camera Access:

• Used for video calls through the Juphoon SDK.
• Requires explicit permission granted at the operating system level.
• Video data is transmitted in real time only and is neither recorded nor stored.

Authentication and Authorization:

All sensitive functions require users to be authenticated through App login. Operating system-level permission prompts ensure that user consent is obtained before accessing any sensitive hardware features.


Q5: Do you conduct security testing, security audits, vulnerability assessments, and/or penetration testing for the application and supporting infrastructure? If yes, please provide confirmation, including the frequency and scope of such activities where available, along with a summary of findings or other supporting evidence that can be shared.

Yes. Security testing activities have been conducted, including:

• Vulnerability assessments for the application and server infrastructure.
• Secure code reviews throughout the software development lifecycle (SDLC).
• Periodic penetration testing.

Frequency:

Vulnerability assessments are conducted approximately every three months. Security patches are deployed on an as-needed basis according to identified vulnerabilities and security findings.

Q6: Please describe your process for identifying, assessing, prioritizing, remediating, and deploying updates for security vulnerabilities. Please also explain how critical vulnerabilities are handled and how customers are notified when relevant security updates are available.

Vulnerability Management Process:

1. Identification:

Security vulnerabilities are identified through internal security testing, system monitoring, and external vulnerability reports.

2. Assessment:

Each vulnerability is evaluated based on its CVSS score and potential impact, then classified by severity level: Critical, High, Medium, or Low.

3. Prioritization:

Critical and high-severity vulnerabilities are prioritized for immediate remediation to reduce potential security risks.

4. Remediation:

The development team addresses vulnerabilities through code fixes, security patches, and necessary software updates.

5. Deployment:

After validation and testing, security fixes are deployed through OTA (Over-the-Air) app updates and server-side patch releases.

Handling of Critical Vulnerabilities:

Critical vulnerabilities are handled with the highest priority. Emergency patches are developed, tested, and deployed as quickly as possible to address security risks.

When security updates become available, customers are informed through in-app notifications and release notes.

 

Summary

Data security is a baseline expectation for any connected device provider. We share our security practices openly and remain committed to transparency with customers and partners worldwide. If you have any further questions about security or data protection, please contact us.