How Henosis keeps customer data safe

Fully managed US cloud. Frontend on Vercel (CDN/edge, US origin); database, auth, storage, and serverless functions on Supabase, hosted in AWS US West (Oregon, us-west-1). No on-premise or customer-managed components.

No. It is reached only through authenticated, Row-Level-Security-enforced APIs. There is no public/direct database access.

Logical multi-tenant with isolation enforced at the PostgreSQL layer (Row-Level Security), not just in application code. A request for another tenant’s data is denied by the database.

Yes. TLS 1.2+ in transit (HTTPS enforced); AES-256 at rest for data, backups, and storage (provider-managed). Third-party integration credentials are additionally encrypted at the application layer with AES-256-GCM using a key held outside the database.

No. Stripe (PCI DSS Level 1) handles all card data. We store only billing metadata (plan, seat count, last-4, status).

Email + password via managed auth with signed, short-lived JWT sessions. Enforced password policy: ≥10 characters with upper, lower, number, and special character. MFA is not generally available today; it is on our near-term roadmap.

Not today. SSO is on our enterprise roadmap; we can discuss timeline if it’s a requirement for your deployment.

Production access is restricted to the two founders. A role-gated internal support path exists for troubleshooting and is recorded in audit logs. There is no ad-hoc production database access; all changes go through reviewed source control and CI.

All changes via pull request to a dev branch; production (main) is promoted only by reviewed PR with a security-focused review. Schema changes are version-controlled migrations applied solely by automated CI/CD, no manual production DDL.

Parameterized queries (no string-built SQL), schema-validated inputs (Zod), default output encoding (React) against XSS, field-allowlisted data imports (no mass assignment), rate-limited public endpoints with server-issued tokens, and secrets held in provider secret stores (not in source).

No, not currently. We are establishing the operational controls now and target SOC 2 Type I post-funding. We will share attestation when available, under NDA.

Not yet. We perform internal OWASP-Top-10 security reviews (code review, taint analysis, dependency audit) and have remediated the findings from our most recent cycle. An independent third-party pen test is planned as part of our SOC 2 program; we will share the summary under NDA when complete.

We support GDPR/UK GDPR (lawful bases declared, data-subject rights, US-transfer safeguards) and CCPA/CPRA (no sale/share for cross-context advertising). A DPA incorporating EU Standard Contractual Clauses is available on request. HIPAA/GLBA do not apply; we process no PHI or financial-account data.

You own all data you input; Henosis processes it only to provide the service. You can export your data (CSV/Excel) at any time. On termination, a 30-day export window applies, after which data is deleted (backups age out on their normal cycle).

Yes: automated, encrypted daily backups managed by the database platform. Enhanced point-in-time recovery (sub-24-hour RPO) is a near-term hardening item on our security roadmap.

Yes. Security-relevant and data-change events are written to a tenant-isolated, strict-insert audit log; e-signature actions have a dedicated audit trail (actor, IP, user-agent, timestamp). Operational logging and error monitoring (Sentry) support detection and diagnostics.

We will notify affected customers and regulators as required by law ( within 72 hours of becoming aware where GDPR applies), including the nature of the incident, data involved, and remediation. A formalized incident-response runbook is being finalized as part of launch readiness.