Security & privacy

Your data belongs to you.
We protect it.

Security is a foundation of Enkorix. Every technical decision starts with protecting customer data.

100%
Tenant isolation
TLS 1.3
Encrypted connections
24/7
Continuous monitoring
RBAC
Access control
10
Protection layers
Infrastructure

Built on secure foundations

Each infrastructure layer is selected for security, performance and reliability.

Vercel
Global hosting with automatic DDoS protection, a distributed CDN and TLS-encrypted connections.
TLS 1.3DDoS ProtectionEdge NetworkSOC 2
Neon PostgreSQL
Serverless PostgreSQL with tenant isolation, automatic backups and encryption at rest.
Tenant IsolationAuto BackupEncryption at Rest
Upstash Redis
Caching and rate limiting with encryption in transit and at rest.
Rate LimitingEncryptedServerless
Protection layers

Security at multiple levels

Each level of the system has its own protections.

Authentication & identity
Encrypted JWT sessions with httpOnly cookies, automatic expiry and secure session renewal.
JWThttpOnly CookiesSession Expiry
Role-based access control
Each user has a defined role, with fine-grained permissions for each function.
Role-BasedPer-FunctionTenant-Scoped
Rate limiting & abuse prevention
Per-user and per-IP request limits with Redis help prevent brute-force attacks and resource abuse.
Per-User LimitsIP ProtectionBrute Force Guard
Monitoring & early alerts
Sentry monitors errors and anomalies, with alerts for the technical team.
SentryReal-time AlertsError Tracking
Audit logs
Sensitive operations are recorded: who did what and when, for a traceable history of changes.
Full Audit TrailImmutable LogsTimestamped
API & input protection
Zod input validation, Prisma ORM protection against SQL injection and API request checks.
Zod ValidationPrisma ORMInput Sanitization
Two-factor authentication
Managers and administrators must use TOTP through Google Authenticator or an equivalent application.
TOTPRequired for administratorsGoogle Authenticator
Password protection
Passwords are protected with bcrypt and timing-safe comparisons, including for unknown email addresses. Passwords are never stored as plaintext.
bcryptTiming-safeNo Plaintext
Security headers on every response
HTTP responses carry HSTS, anti-framing protection, MIME-sniffing protection and Permissions-Policy. The embedded assistant call page is the HTTPS-only framing exception. Camera and geolocation access are disabled. Microphone access is restricted to the explicitly listed voice-enabled pages and their English public counterparts, for our own origin only; embedded third parties cannot request it.
HSTS · 1 yearX-Frame DENYMIME SniffingMicrophone: designated pages only
CORS restricted to the official domain
The default Access-Control-Allow-Origin is enkorix.ai. Public widget, voice availability, voice ticket and Reach pixel endpoints serve visitors on customer websites, with tenant domain allowlists where the browser supplies an origin, plus tenant-specific rate, seat and quota controls.
Default: our origin onlyPublic widget: tenant domain allowlistRate + Quota Guard
Data isolation

Your company's data stays separate

Each company works in its own isolated workspace.

Example: 3 companies on one platform, each with separate access
Your company ✓
Real estate company A
142 leads
12 reserved units
5 users
Isolated
Another company
Real estate company B
Private data
Not visible to you
Protected
Isolated
Another company
Real estate company C
Private data
Not visible to you
Protected
Each company has a separate tenantId . Database queries are automatically scoped to that ID through TenantGuard, preventing cross-tenant access through the isolation layer.
Compliance

Ready for your requirements

We build with Saudi and international regulatory requirements in mind and can discuss security details with your technical team.

🇸🇦
A registered Saudi company
Enkorix is a Saudi company built for the Saudi real estate market and its requirements
Personal Data Protection Law
Committed to Saudi PDPL, with contractual safeguards for providers
Trusted payments
Payments through Moyasar, licensed by SAMA and PCI-DSS compliant
Continuous monitoring
Daily automated security checks, with ongoing error and performance monitoring
Frequently asked questions

Questions from IT teams

What technical teams ask before subscribing.

Data is stored on managed cloud infrastructure (Neon PostgreSQL), with encryption and automatic backups. Transfers outside Saudi Arabia use the contractual safeguards required under PDPL. We are working towards a Gulf-region storage option.
The Enkorix team accesses customer data only when needed for direct technical support and with your permission. Access is logged.
You can export your data. The policy provides for permanent deletion from servers 30 days after cancellation.
Role-based access limits what each employee can view and change. Managers and administrators must use TOTP-based two-factor authentication.
Enterprise customers can request a security document covering infrastructure, policies and incident response procedures.

Have another technical question?

Our technical team can answer security questions before you subscribe, with no commitment.

Talk to our technical team →Start your free trial