Security & Trust
Enterprise security you can verify
EngageCloud Pro is built on Google Cloud with encryption at every layer, zero-trust access controls, and compliance frameworks designed for regulated industries.
Data Encryption
All data encrypted at rest with AES-256 and in transit via TLS 1.3. Encryption keys managed via Google Cloud KMS.
Cloud Infrastructure
Deployed on Google Cloud Run with auto-scaling, no persistent compute attack surface, and VPC isolation.
Access Management
Role-based access control, SSO/SAML support, OAuth 2.0 for social integrations, and scoped API tokens.
Monitoring & Logging
Real-time threat detection via Google Cloud Security Command Center, full audit logs, and anomaly alerting.
Compliance
Compliance certifications & frameworks
| Framework | Status | Details |
|---|---|---|
| GDPR | Ready | Data Processing Agreement available. EU data residency options. Right to erasure honored. |
| CCPA | Ready | California Consumer Privacy Act compliance with data deletion workflows on request. |
| SOC 2 Type II | In Progress | Audit underway. Expected certification Q3 2026. Controls documented and enforced. |
| ISO 27001 | Roadmap | Planned for 2027 following SOC 2 completion. Information security management framework. |
Implementation
Security practices in depth
01
Encryption at Rest & in Transit
Database: Firestore with AES-256 encryption at rest
Storage: Google Cloud Storage with server-side encryption
Transit: TLS 1.3 enforced on all API endpoints
Secrets: Google Secret Manager for all credentials and tokens
Social tokens: Encrypted before storage, never logged
02
Infrastructure & Network Security
Serverless containers via Google Cloud Run (no persistent VM attack surface)
Global HTTPS load balancer with Cloud Armor WAF
Container images scanned for vulnerabilities at build time
Zero-trust network access model
Backend ingress locked to load-balancer traffic only
03
Identity & Access Management
Role-based access control (Owner, Admin, Manager, Creator, Viewer)
SSO / SAML 2.0 integration for enterprise customers
OAuth 2.0 for all social media connections
Session tokens with a bounded idle timeout
Mandatory MFA available on all plans
04
Incident Response
Defined incident response runbook with <1-hour detection SLA
Security events logged in Google Cloud Security Command Center
Breach notification within 72 hours per GDPR Article 33
Security contact: security@engagecloud.pro
Bug bounty program available — contact security team
