Security

This page describes the technical and organizational measures Ethere applies to the Service. It is the description of measures referred to in Section 18(c) of the Terms of Service and in Ethere's Privacy Policy, and it is written to be checkable rather than reassuring: every measure below is implemented in the running Service, and the last section states plainly what Ethere does not claim.

Tenancy isolation

Every account and every organization is a separate entity, and their data never mixes. Isolation is enforced in PostgreSQL itself: every tenant table carries row-level security that is enabled and forced, and the policies resolve the current user or organization from the request context. The application's database role cannot bypass those policies, and a new table cannot ship without them — a matrix test fails the build if one does. Deletion and export are anchored to the caller's own identity in the same way.

Authentication

Passwords are hashed with Argon2id, with a minimum cost enforced by the database itself so a weaker hash cannot be written. The policy is 12 to 64 characters, and passwords are screened against a breached-password corpus by k-anonymity — only a five-character hash prefix ever leaves the server. Two-factor authentication (TOTP) is supported with single-use backup codes, and passkeys (WebAuthn) are supported as a second factor. Trusted devices expire after 30 days, sessions expire after a period of inactivity, and changing a credential revokes the account's other sessions.

Transport and browser protections

All traffic is served over HTTPS. Ethere sends HTTP Strict Transport Security with a two-year maximum age, includeSubDomains, and preload — the value the browser preload list requires — and applies a strict Content Security Policy to every page. The session cookie is host-only (the __Host- prefix), Secure, HttpOnly, and SameSite, so a subdomain cannot mint or shadow a session.

Secrets and credentials at rest

Stored credentials — two-factor secrets and store API tokens — are encrypted at the column level, so a database dump alone does not expose them. Application secrets live in a root-only environment file, never in code, logs, or customer exports, and neither the personal export nor the organization export contains credential material.

Backups and recovery

The database is backed up continuously: a full encrypted backup each week, incremental encrypted backups on the other days, and continuous transaction-log shipping, with an encrypted copy held on separate infrastructure from the production database. The recovery point objective is minutes, not hours. Recovery is drilled against the off-site copy, and automated alerting pages if the archive or a backup goes stale.

Monitoring and audit trails

Security events — sign-ins, credential changes, exports, deletions, and lockouts — are recorded in an append-only audit table that the application's database role can insert into and read but never alter or delete, and are retained for 180 days. Login attempts and lockout state are tracked separately. Automated alerts watch for anomalies, including a stalled transaction-log archive or a stale backup.

Abuse protection

Public endpoints are rate-limited in Redis, and the public forms run a layered stack: edge bot management, a Turnstile challenge, request-shape checks, single-use render tokens, and a proof-of-work step. The widget API is deliberately public — its key ships in the customer's HTML — so its cost is bounded per visitor, per conversation, and per widget, with a spend breaker that protects each organization's allowance before any model spend happens.

Data location and transfers

Ethere's own data is stored on infrastructure located in the European Union. The providers that can process personal data, and the transfer safeguards that apply to each, are listed on the Subprocessors page.

Retention and deletion

Retention periods are listed in the Privacy Policy and applied automatically. Data can be exported from the dashboard at any time, and deleting an account deletes its data, with the limited backup-rotation exception described in Section 31 of the Terms of Service.

What Ethere does not claim

Ethere holds no SOC 2 or ISO 27001 certification, and has no third-party penetration-test report to offer. The database server's disk is not encrypted as a whole; what is encrypted is stated above — credentials and secrets at the column level, and backups. Service levels are not committed by default: availability terms apply only where agreed (Section 22 of the Terms of Service). Ethere states these limits rather than leaving them to be discovered during a security review.

Reporting a vulnerability

Report a suspected vulnerability to security@ethere.cloud, the same address published in security.txt. Ethere acknowledges reports and investigates them. Please do not test against another customer's account, and give Ethere a reasonable opportunity to fix an issue before disclosing it.