Security at Endia
Server-side authorization, organization separation, protected credentials, and signed provider integrations — designed for product teams that need evidence before merge.
How we protect customer data
What Endia enforces for customer organizations
Organization separation
Customer organizations are isolated. Cross-organization access is denied through server-side authorization.
Authentication & sessions
Sessions use secure, browser-protected cookies. Authorization is enforced on the server, not the browser alone.
Provider credentials
Integration credentials (for example GitHub and Vercel connections) remain server-side and can be encrypted before persistence when configured.
Evidence access
Verification evidence is scoped to your organization. Downloads can use time-limited signed links when configured.
Release-safety controls
GitHub + Vercel preview verification and billing integrity
GitHub App integration
Preview verification uses a GitHub App install bound to your organization. Webhook deliveries are signature-verified when the webhook secret is configured.
Release checks & evidence
Endia returns a clear release result with supporting evidence. Verification failure must not silently claim success.
Billing webhooks
When Stripe is configured, subscription webhooks are verified with the Stripe webhook signing secret. Plan limits are enforced by Endia.
Secret scrubbing
Common secret patterns (tokens, API keys, bearer credentials) are redacted from artifacts where supported.
Production Endia requires HTTPS for application traffic. TLS is typically terminated at the hosting edge (for example Vercel). Exact TLS versions are provider-controlled and are not claimed here as an Endia-owned cipher suite guarantee.
Changes go through source control. Dependency and static checks are part of engineering practice. Internal operator tools are separated from customer product surfaces.
Endia is not currently SOC 2 or ISO 27001 certified. We do not publish GDPR or CCPA compliance attestations, penetration-test summaries, contractual 99.99% uptime SLAs, or downloadable SOC 2 reports on this site.
We use security controls designed around common SaaS security principles while we mature toward formal certification. Provider subprocessors (hosting, database, billing, email) apply their own controls as documented by those providers.
You can request Endia's security overview for procurement conversations.
Request security overviewVulnerability disclosure
Report security issues in good faith. See our disclosure policy for scope and expectations. We do not currently operate a public bug bounty.