Security
Security and privacy are foundational to trust. Here's how we protect your data and your users.
Security Practices
Encryption
- TLS 1.3 for all data in transit
- AES-256 encryption at rest
- Bcrypt password hashing (10+ rounds)
- API keys hashed before storage
Access Control
- Role-based access (RBAC)
- JWT authentication with short-lived tokens
- Rate limiting on all API endpoints
- IP-based geo-restriction (optional)
Infrastructure
- PostgreSQL with restricted access
- Redis with authentication
- Docker containerized deployment
- Regular dependency audits
Data Privacy
- No personal data in widget analytics
- AI chat messages processed and discarded
- Translation cache: text only, no PII
- GDPR-compliant by design
Code Security
- Input validation with Zod schemas
- SQL injection prevention via ORM
- XSS protection via helmet.js
- CORS configured per-domain
Incident Response
- 24-hour incident response (Enterprise)
- Automated alerting and monitoring
- Post-mortem process for all incidents
- Status page for service health
SOC 2 Roadmap
We are working toward SOC 2 Type II certification. Enterprise customers requiring compliance documentation can contact our team for our current security posture report.
Request Security ReportResponsible Disclosure
If you discover a security vulnerability, please report it responsibly:
- Email: security@encludo.com
- We will acknowledge your report within 24 hours
- We aim to resolve critical vulnerabilities within 72 hours
- We will credit researchers (with permission) in our security advisories