Security report

This page explains how Enthuzy protects your account and your data, how to report a security problem, and what we have changed recently. We only list protections that are in place today. We update it whenever we complete a security scan or make a significant change.

How we protect the platform

Encryption in transit. Every connection to enthuzy.com and to every Site on it uses HTTPS. Our certificates are checked every day and listed on the Trust Center.

Encryption at rest. Sensitive fields are encrypted before they reach the database, with an integrity check so tampering is detected. That covers private messages, venue addresses, the keys and tokens for services you connect, and payout details. Passwords are hashed and cannot be read back. Two-factor secrets are stored encrypted.

Sign-in protection. Every account can turn on two-factor authentication with an authenticator app, or use passkeys. Passwords must be at least 10 characters with upper and lower case letters and a number, and are checked against known breached passwords. Sign-in, two-factor codes, passkey sign-in, sign-up and password resets are all rate limited to slow down guessing.

Verified accounts. New accounts must confirm their email address. Unverified accounts stay hidden from the public and are removed after a set period.

Bot and abuse protection. Sign-up and public forms are protected by Cloudflare Turnstile. Attempts to inject scripts through any input are logged. The account is warned once, then blocked, and the address is queued for review by a person.

Your content is cleaned. Rich text and page content are sanitised before they are stored or shown, so content added by one person cannot run scripts for another. Every form and action is protected against forged requests, and database queries use bound parameters.

Separation between Sites. Each Site decides which team members can see or change each area. A person only sees the Sites and data they have been given access to, and sensitive actions are written to an audit log.

Private documents stay private. Signed contracts, tax forms and similar documents are kept in private storage. They are never reachable through a public link and are only served after we check that the person asking is allowed to see them.

Payments stay with Stripe. Card details go straight to Stripe. Enthuzy never stores card numbers, and each Site is paid out through its own Stripe account.

Receipts. The receipt camera finds the edges and crops the photo on your own device before anything uploads. On Pro accounts the receipt is read by a scanner that Enthuzy runs, over an encrypted connection, and it is not shared with anyone else.

AI writing help. If you add your own AI provider key, it is stored encrypted, cannot be viewed again after you save it, and is only used to make your requests. Only the text you ask it to work on is sent to the model.

Browser protections. Every page is sent with browser protections: a strict transport policy on secure connections, protection against clickjacking and content-type sniffing, a restrictive referrer policy and a permissions policy that switches off browser features we do not use. A content security policy is running in report-only mode while we confirm that nothing legitimate is affected. Public embeds are the one deliberate exception to the framing rule, since they exist to be placed on other people's pages.

Uploads are scanned for malware. Files uploaded to Enthuzy are checked with the ClamAV antivirus scanner before they are stored, and infected files are rejected.

Monitoring and reviews

Every day an automated scan checks our software dependencies against the public vulnerability advisory database, searches our own code for risky patterns and confirms that our security settings are on. New findings alert our administrators right away, and the code is also checked with a static analysis tool. When a vulnerable dependency is fixed, it is listed below under Vulnerabilities addressed.

Platform status and certificate checks are published on the Trust Center and update continuously. We review the platform's security regularly. The most recent review was completed on October 4, 2026, and we are working through what it found.

Reporting a security problem

If you think you have found a vulnerability, please email security@enthuzy.com. Our machine-readable contact details are at enthuzy.com/.well-known/security.txt.

Helpful details to include:

• What you found and where.
• The steps to reproduce it.
• What you think the impact is.
• How to reach you.

We welcome good-faith research. We will acknowledge your report and keep you updated while we look into it. To keep everyone safe, please:

• Report the problem to us privately and give us reasonable time to fix it before you share it.
• Only use your own accounts and data to test. Do not access, change or delete anyone else's information.
• Avoid anything that could degrade the service for others, such as heavy automated scanning or denial of service tests.
• Do not use social engineering, phishing or physical attacks.

Your data

You can delete your own account at any time from your settings. Our Privacy Policy explains what we collect and why, and the Trust Center lists the companies that process data on our behalf.

What you can do

• Turn on two-factor authentication or add a passkey.
• Use a strong password that you do not use anywhere else.
• Sign out on shared or public computers.
• Keep the email account you use with Enthuzy secure, since it can reset your password.
• Review who has access to your Site, and remove people who no longer need it.
• Tell us if something looks wrong.

Certifications

We have not yet completed a formal certification such as SOC 2 or ISO 27001. The Trust Center lists each one and where we honestly are with it.

Updates

October 21, 2026. Applied the critical PHP security releases published today. As soon as our hosting provider made the patched versions available, we updated PHP on our production server. We also updated Node.js, which we use to build the site's front-end files, to the version that fixes today's Node.js security release, and updated our front-end build tools, which cleared the advisories an audit had reported for them. We then installed the pending operating system security updates and restarted the server so they took effect. Finally, we tightened our internal data store so it only accepts connections from the server itself, and confirmed from outside our network that the database and data store ports cannot be reached from the internet. No action is needed from you.

October 18, 2026. Security hardening following an external scan review. Added browser security headers on every page (with a report-only content security policy), malware scanning of uploads, a daily automated scan of our dependencies, code and settings with administrator alerts, and static code analysis. Removing a page block now only records an audit entry when something was actually removed. We audited all dependencies against the public advisory database and no known vulnerabilities were found, so there were no vulnerable packages to update. We also confirmed that public embeds still work under the new headers.

October 4, 2026. Completed a security review of the platform and began working through the findings. Added this page to the Trust Center.

We add an entry here whenever we complete a security scan or make a significant change to how we protect your data.