Skip to main content
How Enrik isolates, protects and handles your data.

​
Workspace isolation

Every record belongs to exactly one workspace, and all data access is scoped to your active workspace on the server. Data is never shared across workspaces, and switching workspaces re-scopes the entire app. The active workspace is determined server-side from your session (or, for an API key, from the key’s workspace) — it is never taken from anything the browser supplies.

​
Authentication

Sessions are cookie-based and the session cookie is HTTP-only, so it is never exposed to client-side scripts. Passwords are hashed with Argon2id. API keys, invitation tokens and password-reset tokens are stored only as hashes. Session cookies are signed, so a stored session record alone cannot sign anyone in.

​
Credentials you configure

API keys are stored only as hashes and are shown once, at creation. Model-provider credentials, custom-API connector secrets, webhook secrets and integration tokens are encrypted at rest (AES-256-GCM) and never shown back in plaintext.

​
Product analytics

Enrik uses product analytics from PostHog, in its EU region. The web app records page views, product events and errors with your user ID and workspace ID; page addresses are reduced to the screen’s route, without record IDs. The server records usage and error events with your workspace ID. Every event property passes a default-deny allow-list: no emails, prompts, message bodies, request payloads, API keys or secrets. Click autocapture and session recording are off, and there is no survey, feedback or chat widget. There is no setting to turn analytics off yet.

​
Signed outbound webhooks

Enrik sends two kinds of signed request to a webhook destination, and each has its own header. Both are signed with the destination’s signing secret, which it gets when you create it. The secret is shown once, at creation; Rotate signing secret replaces it and shows the new one. Both headers have the form:
To verify a request, your receiver should:
  1. Compute an HMAC-SHA256 over the string `${t}.${rawBody}` using your destination’s signing secret — over the exact raw bytes as received, before any JSON re-serialization — and hex-encode it.
  2. Compare it to the v1 value using a constant-time comparison.
  3. Reject requests whose t timestamp is outside a freshness window, such as 5 minutes, to prevent replay.
This proves the payload came from us and is fresh. Keep your signing secret confidential.

​
Export deliveries

Each export delivery carries X-CRM-Signature. A delivery that fails with a timeout, a network error or a 5xx answer is retried up to two more times within about 30 seconds; a 4xx answer is not retried. Retries carry the same t and signature.

​
Webhook events

Each event carries X-Enrik-Signature, with a fresh t on every attempt, so a retry hours later still verifies; the body bytes never change. A failed attempt is retried for up to 8 attempts over about 45 hours, and a delivery is attempted for at most 72 hours. See Receive webhook events. Only a workspace owner or admin can subscribe a destination to events, or change the address, credentials, headers or signing secret of a destination that has an event subscription.
Beta limitations. Security hardening continues throughout the private beta. To report a security concern, email support@enrik.ai — please do not post details publicly.