The Essentriq security library
Controls you can check,
from the product that ships
Every card describes current behaviour and says where the control lives in a workspace. The last shelf lists what is not in place yet, so a questionnaire gets a straight answer either way. None of it is a roadmap.
Full shelf
35 items
Data protection
Per-workspace envelope encryption
Each workspace gets its own random 256-bit data key, stored only wrapped by the platform master key. Connector credentials and other secrets are sealed with AES-256-GCM under that key, with the workspace id bound as authenticated data, so ciphertext moved to another workspace fails to decrypt.
Default for every workspace
Data protection
Key rotation without downtime
A versioned keyring accepts retired master keys for reading while values are re-sealed under the current one. Rotating the master key re-wraps workspace data keys only; tenant secrets are not re-encrypted in bulk.
Operator-run migration, dry-run first
Data protection
Crypto-shredding on deletion
Deleting a workspace deletes its data key, which renders any remaining copy of its ciphertext unreadable.
Default
Data protection
Data retention you control
A workspace owner sets a retention period; a cleanup run removes audit entries and closed cases older than that cutoff for that workspace only.
Admin → Settings → Data retention
Data protection
Transport and browser hardening
HTTPS with HSTS (two years, preload), a content-security policy, nosniff, strict referrer policy and camera, geolocation and payment access disabled by permissions policy (microphone only for voice input). Uploaded SVGs are never served inline.
Default
Tenant isolation
Database tenant guard
A guard on the data client confines every read, count, update, delete and upsert on a workspace-owned table to the workspace of the current request. Creates are stamped with that workspace; a write that tries to re-assign a row to another workspace is rejected.
Default
Tenant isolation
One trust root per request
The workspace and acting user are resolved once from the session and passed down; routes do not take the workspace from URL parameters.
Default
Tenant isolation
Foreign-key boundaries
Workspace-owned tables reference their workspace with database-level constraints, so a row cannot exist without a valid owner.
Default
Audit log and evidence
Hash-chained audit log
Every audit entry stores SHA-256(previous hash + canonical entry). The first entry chains to a per-workspace anchor. Any edit, deletion or reordering breaks the chain from that point forward.
Default
Audit log and evidence
Chain verification on demand
An endpoint walks the whole chain for your workspace and reports any break. Auditors can run it themselves; it needs no help from us.
Admin → Audit → Verify chain
Audit log and evidence
Public RFC 3161 timestamp anchors
The chain tip is periodically sent to a public Time-Stamp Authority. The signed reply proves the chain existed in that state at that time, and anyone can check it with standard OpenSSL tooling, independent of Essentriq.
Default; TSA list is configurable
Audit log and evidence
Evidence hash on every applied change
Secure Apply records operator intent and a SHA-256 evidence hash; read-back verification against the directory closes the case with the before/after state.
Default on every case
Audit log and evidence
Export
Audit entries and anchors can be exported for retention outside the platform.
Admin → Audit → Export
Access to Essentriq itself
Single sign-on
Google sign-in today, with the workspace resolved from the signed-in identity. Microsoft Entra ID sign-in is built and switches on once our Microsoft app registration is live.
Platform sign-in; users join their workspace by verified company domain
Access to Essentriq itself
Multi-factor authentication
Time-based one-time codes (RFC 6238) compatible with Microsoft Authenticator, Google Authenticator, 1Password and Authy, with hashed recovery codes. A workspace can require enrolment for every password user.
Per user; “Require MFA” per workspace
Access to Essentriq itself
Password storage
Passwords are stored as salted bcrypt hashes. We cannot read them.
Default
Access to Essentriq itself
Role-based access and separation of duties
Admin, operator and requester roles; approval policies can require different people to request, approve and apply, with separation-of-duties checks at approval time.
Admin → Profiles, Admin → Separation of duties
Access to Essentriq itself
Rate limiting
Sign-in (per account and per address), MFA and sign-up endpoints are limited with a shared fixed-window limiter held in the database, so limits hold across instances. If the database is unavailable the limiter fails safe, not open.
Default
Integrations
Sealed connector credentials
Directory, HRIS and service-desk credentials are stored under the workspace data key and never returned to the browser after entry.
Default
Integrations
Signed outbound webhooks
Every delivery carries an HMAC-SHA256 signature with a timestamp (X-Essentriq-Signature: t=…, v1=…), is retried up to three times and is recorded with its outcome.
Integrations → Webhooks
Integrations
Token-based feeds, shown once
SCIM, HR-feed and reporting (OData) tokens are stored as SHA-256 hashes and displayed exactly once at issue. Rotating a token revokes the old one immediately.
Admin → Settings
Integrations
Read-back, not trust
After a change is applied, the directory is read back and compared to the plan. The case does not complete on the API’s success response alone.
Default on every case
Operations
Health signals without tenant content
Platform health and alert endpoints report database latency, stuck provisioning jobs and error counts. They never return workspace content or secrets.
Default
Operations
Error tracking scoped to the workspace
Application errors are fingerprinted and recorded per workspace, with counts and last-seen times, and are visible to that workspace’s admins.
Admin → Errors
Operations
Humans decide
Drafts and suggestions may be generated, but a named person confirms every field and owns every decision; nothing is applied to a directory without a recorded operator.
Default
Data & privacy
Data hosting location
Essentriq runs on managed cloud infrastructure in a United States region. The database, file storage and backups stay in that region. Regional hosting elsewhere is not offered yet.
Platform default
Data & privacy
Subprocessors
Our cloud hosting and AI provider (hosting, database, storage, transactional email, language-model API), Stripe (billing), Microsoft and Google (single sign-on, only when connected), and a public RFC 3161 timestamp authority that receives only a hash. Your own connected systems are not our subprocessors.
Privacy Policy → Subprocessors
Data & privacy
Data deletion
Deleting a workspace destroys its data key first, so ciphertext left in backups is unreadable. Retention cleanup removes audit entries and closed cases older than the window your admin sets. Workspace and audit exports are available before you delete.
Admin → Settings → Data retention; Admin → Audit → Export
Data & privacy
AI data usage
Assist sends only the current record and your typed request to the model, through our AI model provider, for a single response. Essentriq keeps no copy of the prompt beyond the draft you accept, and Essentriq does not use customer data to train models. Full detail on the Assist page.
Assist → AI and your data
Data & privacy
Data processing agreement
A standard DPA is being prepared and will be linked from the Privacy Policy. Until then the Privacy Policy and Terms of Service govern processing.
Not yet published
Data & privacy
Security contact
Report vulnerabilities to [email protected] with "Security" in the subject. Reports go to the founder directly. A formal disclosure policy is still being prepared.
Contact page
Not yet in place
Third-party attestations
No SOC 2, ISO 27001 or penetration-test report exists yet. We will publish them here when they do, not before.
Not yet in place
Public status page
Health endpoints exist for uptime monitors; a public status history does not. It will be linked here once it is backed by real monitoring data.
Not yet in place
Customer references
Essentriq is newly launched. Reference customers and results appear when customers agree to be named.
Not yet in place
Row-level database policies
Isolation is enforced by the application data layer and database constraints today. Database-level row policies are planned as a further layer.
Want to verify any of this yourself?
Start a workspace, run the chain verification, rotate a token, follow a change end-to-end. Or ask us for the specific control you need and we will show you where it lives.