How Henosis keeps customer data safe

In a fully managed US cloud. The frontend is served from Vercel’s edge network with a US origin. The database, authentication, storage and server-side functions run on Supabase in AWS us-west-1 (Northern California). Nothing runs on customer-managed infrastructure.

No. The application reaches the database only through authenticated APIs that enforce row-level security. Direct database connections exist only for the deployment pipeline and the three named individuals.

Logical multi-tenant. Isolation is enforced by PostgreSQL row-level security on every table (115 of 115 on September 7, 2026), so a request for another workspace’s data is denied by the database, whatever the client sends.

Yes. TLS 1.2 or higher in transit, with HTTPS enforced and HSTS preload. AES-256 at rest for data, backups and storage, managed by the providers. Connected-mailbox credentials carry a second layer of AES-256-GCM encryption with a key held outside the database, and only the server-side function that needs a credential can read it.

No. Stripe (PCI DSS Level 1) handles all card data. We store billing metadata only: plan, seat count, status, and the card brand, last four digits and expiry as reported by Stripe.

Email and password through managed authentication, with signed sessions that expire after one hour and refresh tokens that rotate on use. Passwords need at least ten characters with upper case, lower case, a digit and a symbol, enforced on the server, and passwords found in known breach lists are rejected. New accounts confirm their email address before signing in. MFA: the provider supports time-based one-time codes and the capability is switched on, but REP does not yet offer enrollment in the app. It is on the near-term roadmap.

Not today. SSO is on the enterprise roadmap. Tell us if it is a requirement and we will discuss timing.

Three named individuals hold access to the production database and console: the founder and the CTO as owners, and one technical advisor as an administrator. The same three hold source-code access. There is no shared login and no ad-hoc production database access; changes reach production through source control and the deployment pipeline. A role-gated operator path exists for support and provisioning and is recorded in the audit log.

Anthropic (Claude) is the primary model and OpenAI is used for selected features. Both are called from the server, never from the browser, and their API terms exclude using the data to train their models. Perplexity and Firecrawl are used for web research in lead discovery and enrichment; they receive search queries and public web content, not your records. AI usage is metered per workspace against a spend cap enforced on the server.

Work lands on a dev branch, which deploys to the development environment. Production is updated only by a pull request from dev, opened and merged by the founder after the pre-promotion audit. Every pull request runs a build identical to the production build. Schema changes are version-controlled migrations applied by GitHub Actions; there is no manual production DDL. Branch protection with required reviews and status checks is a planned repository upgrade.

Parameterized queries through the database SDK (no string-built SQL), schema-validated inputs (Zod), React’s default output encoding against cross-site scripting, field-allowlisted CSV and Excel imports (no mass assignment), allowlisted redirect targets on billing and checkout, signature verification on Stripe and Nylas webhooks, rate-limited public signing links with server-issued tokens, and secrets held in provider secret stores. A repository check on September 7, 2026 found no credentials in the source.

No, not currently. Operational controls are being established now and SOC 2 Type I is targeted after funding. We will share the attestation under NDA when it exists.

Not yet. We run internal reviews against the OWASP Top 10 (code review and dependency audit) and a recurring multi-perspective audit with a dedicated tenant-isolation lens; the most recent audits ran on August 21, 24 and 27, 2026. Two internal adversarial reviews in July 2026 produced 64 findings; the critical and high items were fixed and promoted to production, and the open items are listed on the roadmap below. An independent penetration test is planned as part of the SOC 2 program.

We support GDPR and UK GDPR (lawful bases declared, data-subject rights, US-transfer safeguards) and CCPA/CPRA (no sale or sharing for cross-context advertising). A DPA incorporating EU Standard Contractual Clauses is available on request. HIPAA and GLBA do not apply; we process no PHI or consumer financial-account data.

You own everything you enter; Henosis processes it only to provide the service. You can export your data (CSV or Excel) at any time. On termination there is a 30-day export window, after which the data is deleted and backups age out on their normal cycle.

Yes. Automated, encrypted daily physical backups with continuous write-ahead-log archiving, managed by the database platform on its paid plan and kept on a rolling seven-day window. Point-in-time recovery (sub-24-hour RPO) is an available add-on that is not yet enabled; it is on the near-term roadmap.

Yes. Security-relevant and data-change events go to a tenant-isolated audit log that the database keeps append-only through row-level security (inserts and reads only). Every e-signature action (created, sent, viewed, signed, declined, expired, reminder) is recorded with actor, IP address, user agent and timestamp, and the sent document carries a tamper-evidence hash that is checked at signing.

We notify affected customers and regulators as required by law, within 72 hours of becoming aware where GDPR applies, with the nature of the incident, the data involved and the remediation steps. A formalized, tested incident-response runbook is being finalized.