Security and Trust

Last updated: 29 October 2026. Summarises Annex B and Annex C of the Data Processing Agreement, version 1.1.

Enalitica processes the orders, leads and advertising data of the stores and service businesses that use it, so this page sets out, in one place, how that data is protected. It is a plain summary of the technical and organisational measures in Annex B of our Data Processing Agreement, which is the binding version and prevails if anything here reads differently.

Hosting and network

Enalitica runs on dedicated Hetzner servers in the EU (Germany and Finland), connected through a private network.
All public traffic goes over TLS, with certificates renewed automatically, in Full (strict) mode.
Ports 80 and 443 are reachable only through the protective proxy. SSH and administrative interfaces are restricted to authorised IP addresses.
The database is not publicly reachable. Production and development are separate environments, and development access uses a least-privilege database user.

Application security

Multi-tenant isolation: every data access is scoped to the tenant in code. A mandatory security checklist and automated security checks run before every release.
Authentication uses expiring sessions, login rate limiting, account lockout, CAPTCHA and optional two-factor authentication.
The tracking script honours consent management platforms. Without consent it neither stores nor sends data.
Error messages shown to users are generic. Details are logged server-side only, without sensitive content.

Encryption and credentials

Order personal data are encrypted at field level with envelope encryption. The keys are held by a dedicated key management service on a separate host, with a separate key per tenant, and access to encrypted data is recorded in an audit trail.
Connection credentials (OAuth tokens, API keys) are stored encrypted. Secrets are managed centrally and never kept in source code.
Email addresses used for cross-device linking are stored only as SHA-256 hashes and deleted automatically after 90 days.

Backups and deletion

Backups run daily, compressed and encrypted with envelope encryption: every backup file has its own key, generated and wrapped by the key management service on a separate host, so the application server never holds the master key.
Backups are kept for 30 days, stored in the EU. Restore is an administrator-only operation and the restore procedure is tested.
When a tenant is deleted, the tenant's encryption keys are deleted as well, which makes any residual data unreadable.

People and operations

Production access is limited to a small circle of authorised persons bound to confidentiality, on a least-privilege basis.
Operations and security signals are monitored with alerting, and a documented incident handling procedure includes notifying customers as set out in Section 8 of the DPA.
System software and dependencies are kept up to date, with a vulnerability review on every dependency change.

Where data goes

Processing takes place on servers in the EU. Sub-processors outside the EU are covered by Standard Contractual Clauses, as listed on the sub-processors page.
AI providers (Anthropic, OpenAI, Google) are used only where you enable the corresponding module, only with aggregated data that contain no personal data, and only on paid provider accounts on which submitted data are not used for model training.
Services you connect with your own accounts (your shop platform, Google, Meta, LinkedIn, Mailchimp, Klaviyo, payment and delivery providers) are not our sub-processors: they process data under your own agreement with them.

Sub-processors

The providers that process personal data on our behalf, with their processing location and transfer basis, are listed on the sub-processors page and in Annex C of the DPA. We inform customers of a new or replaced sub-processor at least 30 days in advance (DPA Section 6.2).

Reporting a security issue

If you believe you have found a vulnerability in enalitica.com or app.enalitica.com, write to [email protected] with the steps to reproduce it. Please do not access or change other people's data while testing, and give us reasonable time to fix the issue before you disclose it. Our contact details are also published in machine-readable form at /.well-known/security.txt.