Security is everything at Enhancio. We are committed to being transparent about our practices and helping our customers understand our approach to security. As a 100% GDPR compliant company, data privacy and security lie at the core of our technology and our culture. Delivering excellent service while protecting our customers privacy and data are of utmost importance to us.

Authentication Security

Multi-Factor Authentication

To reduce the risk of unauthorized access to data, Enhancio employs multi-factor authentication for administrative access to systems with highly sensitive data.

OAuth2 for Authentication

Enhancio application uses OAuth2 based authentication to eliminate the risk of unauthorized access.

Password Management

Enhancio strictly enforces a set of password requirements to ensure security standards are met:

  • Passwords must be a minimum of 8 characters in length and include a mix of uppercase and lowercase letters as well as numbers and symbols.
  • Temporary password reset link will be sent to the user's pre-registered email address if the user clicks the forgot password link. If need be, users account can be disabled manually.
  • End-user account passwords stored on Enhancio servers are encrypted.

Secure Credential Storage

Credentials are stored in encrypted form and are not in human-readable format. 

API Security & Authentication

By default, Enhancio's services are served over Organization validated SSL. Services which require an authentication are only served over HTTPS. 

System Monitoring and Logging

Monitoring

Enhancio monitors servers and workstations to retain and analyze a comprehensive view of its corporate and production infrastructure. Administrative access, use of privileged commands, and system calls on all servers in the Company's production network are logged.

Logging

Enhancio collects and stores production logs. Access to the logs are restricted to members of the Security team.

Data Encryption in Transit

Enhancio transmits data over public networks using strong encryption. This includes data transmitted between our customers and our cloud-based service. 

Data at rest is hosted in data centers maintained by industry-leading service providers. Data center providers offer state-of-the-art physical protection for the servers and related infrastructure that comprise the operating environment for Enhancio’s services. These service providers are responsible for restricting physical access to Enhancio’s systems to authorized personnel.

Session Management

Session Timeout

Sessions are set to expire upon 120 minutes of inactivity, continuous sessions will timeout after 8 hours.

Sign Out

When sign out occurs, all session cookies from the client are deleted and the session identifier is invalidated. 

Additional Product Security Features

User Privileges & Roles

Enhancio provides granular access rights which can be configured to set permission levels, based on user roles, for different users to manage users, approve, review, sign, integrate, edit, and read.

Network and Transmission Controls

SSL/TLS

Enhancio utilizes industry-standard communication encryption technologies to ensure all communications are secured. Therefore, all end-user communications within Enhancio are secured with encryption. The connection is protected by Organization validated SSL/TLS everywhere.

Network Security

Protection

Enhancio updates its network architecture continuously. Redundant firewalls, secure HTTPS transport over public networks and the latest router technologies are in place to ensure maximum protection.

Architecture

DMZ is used to add an additional layer of security to the architecture of our local area network. With DMZ, services have different subnets (databases, cache layer or application servers) according to their sensitivity levels. Each zone has specific monitoring and access controls.

Access Logs

Enhancio has comprehensive activity monitoring system that stores logs at all account levels for sign-in/sign-out to user accounts, creating users, setting user permissions and password changes, and creating, deleting, updating, starting and/or pausing scenarios/personalization.

Data Confidentiality and Job Controls

Internal Access to Data

Your account data stored on Enhancio's servers cannot be accessed by employees or contractors unless they need this information to perform a specific job function, i.e. providing customer support. If need be, employees need to use very strong passwords and two-factor authentication to access Enhancio's servers.

Job Controls

On top of having strict rules and regulations for accessing data on our servers, Enhancio employees are required to sign confidentiality agreements before they are allowed to access our servers.

Employee Vetting

Background Checks

Under our zero-trust policy, all employee access to our servers is logged and audited. In case of an abuse, Enhancio employees are subject to disciplinary action, including but not limited to termination. All Enhancio employees are background checked prior to the employment.

Confidentiality Agreements

All new employees go through security screening during our hiring process and they are required to sign confidentiality and Non-disclosure agreements.

Security in Engineering

Product Security Overview

We run in-depth vulnerability assessments using end-to-end, unit and integration tests and have deployment controls in place.

Code Assessments

Our engineers conduct peer code reviews to ensure highest quality and our automated code tests are designed to detect and fix common vulnerabilities. We also conduct manual tests on sensitive areas of our code base.

Availability Controls

Disaster Recovery, Failover and DR

Enhancio was built with disaster recovery in mind. We use Amazon Web Services (AWS), a well-known cloud service provider. To mitigate service interruption risks in case of a disaster, we replicate data and keep them in multiple data centers. In case of a disaster or fail, services will not be interrupted.

We perform continuous backup of data. Headquartered in New York, with an offshore subsidiary in Bangalore, India, we can ensure hundred percent support in case of a disaster to ensure business continuity.

Incident Response

Enhancio has an Incident Response team that quickly and systematically respond in case of a security incident. You can write to us at security@enhancio.com.

Segregation Controls

Data Segregation

Each customer account data is logically separated from other customers. Every customer's data is solely used for that customer and only accessed to provide support to that customer. We will never share or sell customer data to 3rd parties. Our policy around data protection is clearly outlined in the Data Processing Addendum (DPA).

Physical Security

Enhancio services and data are hosted on Amazon Web Services (AWS) facilities in United States and in Ireland. Access to data centers is strictly limited to authorized personnel with verified biometric identity. AWS data centers are physically protected by security guards, video monitoring and other on-premise security measures.

All Enhancio servers are within our virtual private cloud (VPC). We have network access control lists (ACLs) in place to prevent unauthorized requests. We keep testing and staging environments physically separate from the production environment. Service Data is not used in the development or test environments.

Additional Terms

If you have any questions regarding Enhancio's security measures, please write to us at security@enhancio.com  or contact our Support at support@enhancio.com

Our security measures are subject to change, as building data security is a continuous process that shapes the foundation of our development processes and outstanding performance of our industry-leading technologies. We may update this page from time to time to reflect changes. Therefore, please check this page often. The use of Enhancio services is subject to the terms, conditions, and disclaimers in our Terms of Service.