How we protect your projects

Where your data lives

• The application, its database and stored files run on servers hosted by IONOS in the United States.
• Nightly backups are encrypted and kept as off-server copies in the United States.
• Cloudflare provides our domain name service, encrypted connections and network protection.
• We send your content to no artificial intelligence model provider. The application’s search runs on our own servers.
• Emails sent to our enexus.cc addresses, including replies to email sent from the application, are kept by our email provider, Hetzner, in Germany.
• Our full list of subprocessors is on the Subprocessors page. We give 30 days’ notice before adding one.

Encryption

• All connections to the website and the application are encrypted with TLS 1.2 or 1.3, and browsers are told to use only encrypted connections (HTTP Strict Transport Security).
• Access tokens for connected services such as Google, Microsoft, DocuSign and ArcGIS Online, two-step sign-in secrets and webhook secrets are encrypted in our database with authenticated encryption, under a separate key for each organization.
• Backups are encrypted with AES-256 before they are stored.
• Passwords are never stored; we keep only a one-way Argon2 hash.
• The live database and stored files are protected by our hosting provider’s physical security and our access controls; we do not add a further layer of encryption to them today.

Signing in

• Passwords must be at least 12 characters and are checked against lists of passwords exposed in known breaches, without the password leaving our servers.
• Two-step sign-in with an authenticator app or a passkey, with recovery codes. On Firm and Enterprise plans, your organization’s owners can require it for everyone.
• Sign-in with Google or Microsoft accounts, for people your organization has invited.
• Single sign-on through your identity provider (SAML or OpenID Connect), with automatic user provisioning (SCIM), on Enterprise plans.
• Repeated failed sign-ins are slowed down and then locked out.
• On Enterprise plans, your organization can allow sign-in only from its office networks and set shorter session limits of its own.
• Sessions end after 7 days without use and after 30 days at most, and can be signed out remotely. Sign-in cookies cannot be read by scripts and are sent only over encrypted connections, and every change is protected against cross-site request forgery.

Access and separation

• Roles for each organization (owner, administrator, member, viewer) and each project (owner, reviewer, editor, reader) decide who can see and change what.
• Every request is checked against the person’s organization and role, and is refused if the check cannot be made. The database itself also keeps each organization’s data apart, and each organization’s stored files are kept in a storage location of its own.
• Limits on requests and heavy actions protect the service from abuse and runaway automation.
• Changes, approvals, exports and deletions are recorded in an activity history your organization can review and that is never edited.
• Every uploaded file is checked for viruses before anyone can open or download it. An infected file is set aside, and the person who uploaded it and your organization’s owners and administrators are told.

Our staff

Only named administrators at our company can open a customer’s workspace, to give support, administer the account or investigate a problem. Each time they do, it is recorded in that organization’s activity history, along with everything they do there. They cannot see the calendar events of connected Google or Microsoft accounts.

Starting with the fourth quarter of 2026, we review every quarter who holds administrative access, at our company and in each customer organization, and every time our staff opened a customer’s workspace. Our servers accept administrative access only with named keys, and their firewalls admit only the traffic the service needs.

Backups and recovery

The database and stored files are backed up every night and before each release. Each backup is encrypted, checked, and kept as an encrypted off-server copy in the United States for up to 30 days under a retention lock. Every month we restore a backup into a separate database and check that it matches.

A deleted project stays in Recently deleted for 30 days, where your organization’s owners and admins can restore it or delete it for good. After that it and its files are removed, and backup copies expire within a further 30 days.

Monitoring and response

• An external monitor checks the service’s health and alerts us when it fails, and our servers alert us about disk, memory, load, backups and certificates.
• A public status page at app.enexus.cc/status shows the current state of the service.
• Application errors are reported to us through Sentry, with names, email addresses, request contents and files removed first.
• Server logs redact sign-in tokens and other secrets.
• We follow a written incident response plan. If a security incident affects your data, we will tell you without undue delay, as our Data Processing Addendum describes.

How we build

• Changes to the application are checked by an automated test suite, including tests that try to reach one organization’s data from another, before release.
• Each release is made from a recorded version after a backup, is itself recorded, and can be rolled back.
• We reviewed the application against the OWASP Top 10 and the OWASP Application Security Verification Standard (Level 2) in October 2026.
• The website and application load no advertising, analytics or other third-party tracking scripts.
• The application sends only a site’s location to public agency data services, never your name, your client’s name or your files.

Our policies

We keep written policies for information security, access control, change management, incident response, backup and recovery, vendor management, data retention, encryption, acceptable use and secure development, and review them at least once a year.

Your controls

• Invite people with the least role they need, and remove them when they leave.
• Require two-step sign-in for your organization.
• Review a project’s activity history at any time.
• Download a full copy of your organization’s data from Settings › Data & export.
• Disconnect a connected Google, Microsoft or ArcGIS Online account in Settings › Apps; we delete its stored tokens, and for Google and Microsoft calendars, the events we synced.
• Delete a project and its files when you no longer need it.
• Close your organization in Settings › Organization. It stays read-only for 30 days so you can export your data, and is then deleted. When an owner deletes a person’s account, their sign-in details, two-step sign-in records and connected accounts are removed with it.

What we are working on

These are planned and not yet in place:

• An independent penetration test.
• Regular automated checks of the software we depend on for known vulnerabilities.
• Requiring two-step sign-in for every account at our company.
• A SOC 2 readiness assessment.

Certifications

We do not yet hold a SOC 2 report or ISO 27001 certification, and no independent penetration test has been done. Our hosting and network providers hold their own certifications. We answer customers’ security questionnaires and will share our Data Processing Addendum and its security annex on request.

Security questionnaires

For our answers to your security questionnaire, or a call with your IT team, email [email protected] with your organization’s name.

Reporting a vulnerability

If you believe you have found a security problem, email [email protected] with the details (our security.txt is at enexus.cc/.well-known/security.txt). Please give us reasonable time to fix it before disclosing it, and do not access other customers’ data or disrupt the service. We will not take legal action against good-faith research that follows these rules.