No. Enrow doesn't hold a SOC 2 or ISO 27001 certification of its own. Your data is hosted by Amazon Web Services (AWS) in Paris, and AWS holds the ISO 27001, SOC 1, SOC 2 and SOC 3 certifications. For a security review, Enrow can send you its latest independent penetration test report and a completed CAIQ security questionnaire, under a non-disclosure agreement (NDA).
How Enrow protects your data
Hosting in the EU: all data is stored on AWS servers in Paris (region eu-west-3). The databases are in a private network, with no public access.
Encryption: data is encrypted at rest (AES-256) and in transit (TLS 1.2 or higher).
Passwords: stored as an irreversible hash (bcrypt). Enrow never knows your password.
Payments: card details are handled by Stripe, which is PCI-DSS certified. Enrow never stores or sees your card number.
Internal access: multi-factor authentication protects all critical access, and only two people can access the production systems.
Backups: encrypted, every day.
Monitoring: actions are logged, and alerts are sent automatically when something looks abnormal.
Testing: an independent company runs a penetration test every year. Code changes are reviewed, and dependencies are checked automatically for known vulnerabilities.
Staff: everyone with access to personal data signs a confidentiality undertaking and is trained on data protection.
Two-factor authentication
Two-factor authentication isn't available yet for your Enrow account. Protect your account with a strong password that you use only for Enrow, and never share your login: each person must have their own account. To work with colleagues, invite them to your team (see Invite members and manage roles).
Security documents you can ask for
Write to [email protected] and say what you need. Enrow can send:
the report of its latest independent penetration test;
a completed CAIQ (Consensus Assessments Initiative Questionnaire);
its information security policy and its business continuity plan;
the full list of its data providers.
These documents are sent under an NDA.
Under the DPA, you can also ask for one audit a year, with 30 days' notice and at your cost. Enrow may send you the documents above, less than 12 months old, instead of an on-site audit.
If something goes wrong
Data breach: Enrow informs the affected customers and the French data protection authority (CNIL) within 72 hours. It also informs the people concerned directly when the risk to them is high.
Lost password, or account used by someone else: write to [email protected] right away, and change your password (see Change or reset your password).
API key exposed, for example published in code: reset it right away (see Find, copy or reset your API key).