What We Mean When We Say Endia Is Secure

Plain language

When Endia says the product is secure enough to operate, we mean specific controls that are implemented and reviewed — not a marketing synonym for “we care about security.”

The public source of truth is /security.

Explicit non-claims

Endia does not currently hold:

• a SOC 2 Type II attestation
• an ISO 27001 certification

We will not imply otherwise with badges, “in progress” framed as fact, or downloadable fake reports.

If your procurement process requires those attestations, ask for them directly — and treat “not certified” as a valid answer today.

Controls that are actually implemented

Summarized from the public security page (inspect that page for full detail):

• Organization-scoped authorization (tenant isolation) with fail-closed wrappers
• SSRF protections on preview and navigation URLs
• Secret redaction helpers; secrets expected in environment / platform config — not committed to source
• Session cookies HttpOnly + SameSite; Secure in production
• Same-origin checks for cookie-authenticated mutating API routes
• Webhook signature verification when configured (GitHub / Stripe / Vercel)
• Artifact access scoped to organization; optional signed URLs
• Private operational surfaces kept separate from public marketing

What “secure enough” does not mean

• It does not mean every residual risk is closed forever
• It does not mean customers should skip their own review of tenant isolation and integrations
• It does not mean an external auditor has attested Endia

Security work is ongoing. Public claims should track implemented controls and clear certification status — not aspirational slogans.

Checklist for buyers

• [ ] Ask for SOC 2 / ISO only if you need those attestations — and accept “not certified” as a valid answer.
• [ ] Review tenant isolation and artifact access model.
• [ ] Review webhook and SSRF controls if you connect GitHub or Vercel.
• [ ] Prefer concrete control lists over vague compliance slogans.