Encryption everywhere
TLS in transit for all traffic and third-party API calls. Encryption at rest depends on your database host; we recommend a managed Postgres provider, which encrypts by default.
Security
We treat your data like ours.
Practical, no-nonsense security posture. We default to the boring choices, document what we do, and patch fast.
Strong auth, by default
Bcrypt password hashing, JWT access + refresh tokens, optional OAuth providers, API keys constant-time-compared.
Least-privilege access
Role-based access control inside the app (owners, admins, members), least-privilege by default, and audit-logged admin actions.
Tenant isolation
Per-organization data partitioning. Cross-tenant queries are guarded at the repository layer, never trusted at the API.
We don't train on your data
Prompts, documents, and conversations are never used to train any model. Period.
Vulnerability response
Patches for CVEs in dependencies merged within 72 hours. Coordinated disclosure for issues reported by researchers.
What we do, plainly
- TLS in transit between your browser, the app, and third-party APIs
- Encryption at rest follows your database host's defaults (managed Postgres providers encrypt by default)
- JWT short-lived access tokens (30 min) + httpOnly refresh tokens
- Service-to-service API key compared with constant-time comparison, never logged
- Per-org row-level scoping at the repository layer
- Stripe handles all card data; we never see PAN/CVV
- Backup cadence and retention follow your database host's defaults
- Incident postmortems published for any user-facing incident
Reporting a vulnerability
Found something? We want to know. Email security@enswr.com with steps to reproduce. We'll acknowledge within 48 hours and credit researchers who follow coordinated disclosure.
Contact us