Security and trust
Built so security stops saying no.
Edverix separates platform staff from customer organisations at the schema level, scopes every query by tenant and project, and records every administrative action. Enterprise controls are unlocked when a deal needs them: SAML, SCIM, object-level access, PII tokenisation, bring-your-own-key encryption and dedicated data planes.
regionsIN · SG · EU · US · self-hosted
Controls
Access, data protection and governance.
The same capability list the platform page carries, so what security reviews is what the product ships.
Access
SAML single sign-on, SCIM provisioning, two-factor authentication and IP allow-listing at account and user level.
Built-in and custom roles, with separate permissions for building a campaign and approving it.
Partition users, events, segments and campaigns by attribute so a regional team sees only its region.
Primary and secondary keys for zero-downtime rotation, with scopes.
Data protection
Every row carries organisation and project; a request for another tenant's data is refused, not silently filtered.
Sensitive fields stored masked, unmasked only for a specific permission, with a token vault where needed.
Field-level encryption at rest with keys held in your key-management service.
Choose the region your data lives in, or run the whole platform in your own cloud.
Governance
Every administrative action with actor, target and before-and-after state, exportable to your SIEM.
Organisations are verified before activation, with jurisdiction-specific document requirements.
Events, messages and storage metered per project, visible to you in real time.
Data-subject erasure end to end, and retention policies per event type.
Architecture
Four decisions the rest of the platform is built on.
Each one is enforced in code or in the database, not by convention.
Tenant isolation at the schema level
Every row of tenant data carries the organisation and project it belongs to, and a scope service adds that predicate to every query. A request that names another tenant is refused with an error, never filtered quietly, and a lookup for another tenant's id returns not-found so ids cannot be probed.
Keys stored as peppered hashes, shown once
An API key is returned exactly once, at creation. Only a hash of the key combined with a pepper held outside the database is stored, so a leaked table gives nothing to attack offline. SDK keys can write events and devices and nothing else; revocation takes effect immediately.
PII redaction at ingestion
Properties are sanitised before they are stored. Values that look like passwords, card numbers or tokens are replaced with a redaction marker on the way in. Fields you declare as sensitive are stored masked and unmasked only for a specific permission.
Every admin action in the audit log
Role changes, key creation, approvals, exports, retention changes and journey promotions are recorded with the actor, the target and the before-and-after state. The log is queryable in the dashboard and exportable to your SIEM.
Shared responsibility
What the platform guarantees and what remains yours, so the security review has no gaps.
| Control | Edverix | Customer |
|---|---|---|
| Infrastructure and patching | Operates, patches and backs up the hosted platform and its database. | Chooses the region and the retention policy; operates the stack when self-hosting. |
| Tenant isolation | Enforces organisation and project scope on every query and at the schema. | Keeps separate products in separate projects and reviews who holds which role. |
| API keys | Stores keys as peppered hashes, shows them once, limits SDK keys to writes. | Rotates keys on a schedule and keeps service-account keys out of client apps. |
| Identity and access | Provides SSO, SCIM, two-factor authentication, roles and IP allow-listing. | Configures the identity provider, assigns roles and removes leavers promptly. |
| Data sent to the platform | Redacts recognisable secrets at ingestion and masks declared PII fields. | Keeps the tracking plan free of personal data the product does not need. |
| Consent | Honours the SDK consent flag, suppression lists and channel opt-outs on every send. | Collects consent lawfully and passes it to the SDK; maintains its own records. |
| Messaging providers | Encrypts provider credentials per project and logs every send and its outcome. | Owns the provider accounts, sender identities, templates and their approvals. |
| Audit and incident response | Records administrative actions and notifies named contacts of security incidents. | Exports the audit log, monitors alerts and responds within its own process. |
Data residency and deployment
Choose where the data lives.
A region is chosen when the organisation is created and every project in it inherits that choice. Regulated customers can run the whole platform in their own cloud with the same dashboard, SDKs and API.
India
For DPDP-scoped workloads and Indian DLT messaging.
Singapore
For South-East Asian operations that want data to stay in region.
EU
For GDPR-scoped workloads that require processing inside the Union.
US
For teams whose other systems already live in North America.
Your own cloud
Self-hosted on the Enterprise plan: your account, your region, your Postgres.
The region is confirmed at onboarding and written into the order form. Moving an organisation between regions is a managed migration carried out with you, never a silent change.
Sub-processors
A short list, by category, with notice before it changes.
The current list of sub-processors, with entity names and locations, is provided in the Data Processing Agreement and on request. The categories are listed here so you know the shape of it before you ask.
Cloud infrastructure
Compute, managed Postgres and object storage in the region you select.
Transactional email for platform notifications
Invitations, approvals, alerts and security notices sent to dashboard users.
Error monitoring
Application errors from the platform itself, with personal data scrubbed before capture.
Support tooling
Ticketing for support conversations with your named contacts.
We give 30 days advance notice before adding or replacing a sub-processor, by email to the contacts named in your agreement, with the right to object set out in the DPA. Messaging providers you connect yourself are your own vendors and are not on this list.
Compliance posture
Designed to support your obligations. Stated plainly.
The platform is designed to support obligations under the GDPR and India's Digital Personal Data Protection Act. It provides the tooling a controller needs and does not claim a certification it does not hold.
GDPR and DPDP
Regional hosting, a data processing agreement, purpose-bound processing, sub-processor notice and records of processing designed to support your obligations under both regimes.
Data-subject tooling
Erasure and export for a single person from the dashboard or the API, consent and opt-out honoured on every send, and retention policies per event type.
No certification claims
We do not claim SOC 2, ISO 27001 or any other certification on this page. The security packet describes the controls in place and the audits under way, and we answer your questionnaire directly.
Responsible disclosure
Report a vulnerability to security@edverix.com. We acknowledge reports, keep you informed while we fix the issue, and follow a 90-day coordinated disclosure window before details are published. Good-faith research within that process is welcome.
FAQ
Questions security teams ask.
Where is our data stored and who can reach it?
In the region you choose at onboarding, in a Postgres database that belongs to the hosted platform or, on a self-hosted deployment, to you. Platform staff reach customer data only through audited roles, and every such access is recorded in the audit log with the actor and the reason.
Is data encrypted?
Yes. Data is encrypted in transit with TLS and at rest by the managed database and object storage. Enterprise plans add field-level encryption with keys held in your own key-management service, so that sensitive fields cannot be read without a call to your KMS.
How do you handle a data-subject erasure request?
A person can be erased end to end from the dashboard or the API: profile, traits, device tokens, events and message history, including copies in exports still held by the platform. The erasure is recorded in the audit log without retaining the identifiers it removed.
Can we restrict which staff see which data?
Yes. Built-in and custom roles separate building from approving, and object-level access control partitions users, events, segments and campaigns by attribute, so a regional team sees only its region. PII fields can be masked for every role except the ones you name.
Do you sell or share our data with anyone?
No. Your data is processed only to provide the service to you. Sub-processors act on documented instructions under a data processing agreement, and no customer data is used to train models or shared between customers.
What happens to our data if we leave?
You export everything, events, profiles, segments, journeys and the audit log, at any time and with no notice period. After termination the data is deleted from the platform and its backups on the schedule set out in the agreement, and we confirm the deletion in writing.
Get started
Get the security packet and a technical walkthrough.
Send your first event in an hour, simulate your first journey against real history, and keep every byte of it in a database you can query.
- No credit card for the Developer plan
- Bring your own providers
- Export everything, any time