Trust Center
How Enthuzy is running right now, how we protect your data, and where we are on formal compliance. We only say what is true today.
All systems operational
Live from our status page, which also lists incidents and maintenance and lets you subscribe to updates. Open the full status page
Certificates
The TLS certificate each public address is serving, checked daily. A warning appears 21 days before expiry.
How we protect your data
Encrypted in transit
Every connection to enthuzy.com and every Site on it uses TLS (HTTPS). The certificates are checked daily and listed on this page.
Encrypted at rest
Sensitive data is encrypted before it reaches the database with AES-256-CBC plus an integrity check: private messages and their subjects, venue addresses and coordinates, API keys and tokens for connected services (SMS, Printify, Shopify, Etsy, social accounts), and payout handles. Passwords are hashed with bcrypt and two-factor secrets are stored encrypted, so neither can be read back.
Sign-in protection
Authenticator-app (TOTP) two-factor authentication and passkeys are available on every account. Passwords must be at least 10 characters with mixed case and a number, and are checked against known breached passwords. Sign-in, two-factor codes, sign-up and password resets are rate limited to slow down guessing.
Verified accounts
New accounts must verify their email, and unverified accounts stay hidden and are removed after a set period.
Bot and abuse protection
Cloudflare Turnstile guards sign-up and public forms. Attempts to inject scripts into inputs are logged, warned once, then the account is blocked and the IP queued for human review.
Receipts stay in your hands
The receipt camera finds the edges and crops the photo on your own device before anything uploads. On Pro accounts the receipt is then read by a scanner that Enthuzy runs, over an encrypted connection, and it is not shared with anyone else.
Payments stay with Stripe
Card details go straight to Stripe. Enthuzy never stores card numbers, and each Site is paid out through its own Stripe account.
Roles and permissions
Sites control exactly which team members can see or change each area, and sensitive actions are written to an audit log.
Uploads are scanned for malware
Files uploaded to Enthuzy are checked with the ClamAV antivirus scanner before they are stored, and infected files are rejected.
Sanitised content
Rich text and page content are sanitised before they are stored or shown, so user content cannot run scripts.
Your data, your call
You can delete your account yourself from your settings. Our Privacy Policy explains what we collect and why, and the list of companies that process data for us is below.
Private documents
Signed contracts and tax forms (W-9 and W-8BEN) are kept in private storage. They are never reachable through a public link, and are only served after we check that the person asking is allowed to see them. Every upload, download and deletion of a tax form is written to the Site's audit log.
AI writing help stays in your control
Only the text you ask it to rewrite is sent to the model, which is hosted on Amazon Bedrock by default or is the provider you connect yourself. A provider key you add is stored encrypted and can never be read back. We count requests, not their content, and you review every suggestion before using it.
Found a vulnerability? Email security@enthuzy.com. Our security.txt has the details. Read the security report for how we protect the platform and what we've changed recently.
Policies
Last updated 2026-10-18.
Compliance and security reports
Where we honestly are. Nothing here is marked available until we hold it.
Security report
AvailableHow we protect the platform, how to report a vulnerability, and what we've done and are working on. Updated as we run scans and make changes. Last updated October 21, 2026.
Compliance
SOC 2 Type II report
PlannedIndependent audit of our security, availability and confidentiality controls. Not yet started; this entry becomes a downloadable report once an audit is complete.
ISO/IEC 27001 certification
PlannedInternational standard for an information security management system. Planned; no certificate has been issued yet.
Security
Third-party penetration test summary
PlannedAn independent security assessment of the platform with a public summary of findings. Planned.
Legal
Government and law enforcement data request policy
In progressHow we handle legal requests for user data: legal review before anything is disclosed, and telling the people affected where the law allows. A draft exists and is being reviewed; it will be published here once it is final.
Independent legal review of our policies
PlannedAn attorney review of our Privacy Policy, Terms of Service and Master Service Agreement. Planned; not yet done.
Who handles data for us
Companies that process data on the platform's behalf. Last reviewed Oct 4, 2026. When we add a company that handles your audience's data, we update this list first and tell Site owners by email.
DigitalOcean
Hosts the application servers and database that run Enthuzy
Receives: All platform data is stored on and served from these servers. Location: United States (San Francisco)
Laravel Forge
Provisions and deploys our servers
Receives: No customer content. It manages server configuration and deployments only
Amazon Web Services
Storage (S3) for uploaded files, images, receipts and private documents; the load balancer and server for the receipt scanner; and Amazon Bedrock, the hosted AI model behind AI writing help
Receives: Uploaded files and documents; receipt images; the text you ask AI writing help to rewrite. Location: United States
Stripe
Payment processing, Pro subscription billing and payouts to each Site's own Stripe account
Receives: Payment details (sent directly to Stripe, never stored by Enthuzy), buyer name and email, order amounts
Postmark
Transactional email delivery
Receives: Recipient address, and the content of the email being sent
Cloudflare
CDN, DNS and bot protection (Turnstile)
Receives: Web traffic metadata such as IP address, and Turnstile challenge results
Bird / ExpertTexting
SMS, only for Sites that connect their own account
Receives: Recipient phone number and message text
OpenStreetMap (Nominatim)
Finds the map position of venue, hotel and city addresses
Receives: Only the address text
CharityQuery
Verifies a charity's 501(c)(3) status, only when an organizer enters a charity's EIN on an event
Receives: The charity's EIN
Meta (Facebook and Instagram)
Posts you choose to publish, only for Sites that connect their own Facebook or Instagram account
Receives: The post content you choose to publish
Unsplash
Stock photo search in the flyer designer
Receives: Only the search words
Your own AI provider
Only if you add your own key for AI writing help (OpenAI, Anthropic, Google, Mistral, Groq, Together AI, DeepSeek, OpenRouter or one you name)
Receives: The text you ask it to rewrite, under its own terms
Foursquare
Nearby food, coffee and parking suggestions in the Companion app. Only a venue's coordinates and a category are sent
Receives: A venue's coordinates and a category
Printify, Shopify
Product fulfilment and sync, only for Sites that connect them
Receives: Product and order details needed to fulfil an order
GIPHY
GIF search in Companion messages
Receives: Only the search words
Travelpayouts (Aviasales, Klook, Booking.com)
Flight fares and travel partner links in the Companion app, which may earn Enthuzy a commission
Receives: Only the airports and dates being searched, no account details
Canva
Design with Canva in the flyer designer, only when a user chooses it
Receives: The flyer being designed and the user's Canva authorization
Etsy
Import your own shop listings, only for Sites that connect their Etsy shop
Receives: Read-only access to your shop and its listings (titles, descriptions, photos, prices and stock). Nothing is written back to Etsy
Receipt scanner (ABBYY FineParser, run by Enthuzy)
Reads the receipts that Pro accounts upload, only when they do
Receives: The receipt image. It runs on Enthuzy's own AWS infrastructure and is not shared with anyone else. Location: United States