> ## Documentation Index
> Fetch the complete documentation index at: https://docs.enrik.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Security & data handling

> How your data is isolated, protected, and handled — and how to verify our webhooks.

How Enrik isolates, protects and handles your data.

## Workspace isolation

Every record belongs to exactly one **workspace**, and all data access is scoped to your active
workspace on the server. Data is never shared across workspaces, and switching workspaces re-scopes
the entire app. The active workspace is determined server-side from your session (or, for an API
key, from the key's workspace) — it is never taken from anything the browser supplies.

## Authentication

Sessions are cookie-based and the session cookie is HTTP-only, so it is never exposed to client-side
scripts. Passwords are hashed with Argon2id. API keys, invitation tokens and password-reset tokens
are stored only as hashes. Session cookies are signed, so a stored session record alone cannot sign
anyone in.

## Credentials you configure

API keys are stored only as hashes and are shown once, at creation. Model-provider credentials,
custom-API connector secrets, webhook secrets and integration tokens are encrypted at rest
(AES-256-GCM) and never shown back in plaintext.

## Product analytics

Enrik uses product analytics from PostHog, in its EU region. The web app records page views, product
events and errors with your user ID and workspace ID; page addresses are reduced to the screen's
route, without record IDs. The server records usage and error events with your workspace ID.

Every event property passes a default-deny allow-list: no emails, prompts, message bodies, request
payloads, API keys or secrets. Click autocapture and session recording are off, and there is no
survey, feedback or chat widget. There is no setting to turn analytics off yet.

## Signed outbound webhooks

Enrik sends two kinds of signed request to a [webhook destination](https://docs.enrik.ai/export-data.md), and each has its own
header. Both are signed with the destination's signing secret, which it gets when you create it. The
secret is shown once, at creation; **Rotate signing secret** replaces it and shows the new one.

| | Export deliveries | Webhook events (beta, being rolled out) |
| - | - | - |
| What is sent | The records of an export you started | A small event, such as a finished discovery job; never record data |
| Signature header | `X-CRM-Signature` | `X-Enrik-Signature` |
| Retries | Up to 3 attempts within about 30 seconds | Up to 8 attempts over about 45 hours, within 72 hours |
| `t` on a retry | The same `t` and signature | A fresh `t` on every attempt |
| Details | Below | [Receive webhook events](https://docs.enrik.ai/api-reference/webhooks) |

Both headers have the form:

```
t=<unixSeconds>,v1=<hexHmac>
```

To verify a request, your receiver should:

1. Compute an HMAC-SHA256 over the string `` `${t}.${rawBody}` `` using your destination's signing
   secret — over the **exact raw bytes** as received, before any JSON re-serialization — and
   hex-encode it.
2. Compare it to the `v1` value using a **constant-time** comparison.
3. Reject requests whose `t` timestamp is outside a freshness window, such as 5 minutes, to prevent
   replay.

This proves the payload came from us and is fresh. Keep your signing secret confidential.

### Export deliveries

Each export delivery carries `X-CRM-Signature`. A delivery that fails with a timeout, a network error
or a `5xx` answer is retried up to two more times within about 30 seconds; a `4xx` answer is not
retried. Retries carry the same `t` and signature.

### Webhook events

Each event carries `X-Enrik-Signature`, with a fresh `t` on every attempt, so a retry hours later still
verifies; the body bytes never change. A failed attempt is retried for up to 8 attempts over about 45
hours, and a delivery is attempted for at most 72 hours. See
[Receive webhook events](https://docs.enrik.ai/api-reference/webhooks). Only a workspace owner or admin can subscribe a
destination to events, or change the address, credentials, headers or signing secret of a destination
that has an event subscription.

> [!NOTE]
>
> **Beta limitations.** Security hardening continues throughout the private beta. To report a
> security concern, email [support@enrik.ai](mailto:support@enrik.ai) — please do not post details
> publicly.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.