Security at Entwine

Last updated: August 2026

Your ecosystem data — partners, customers, relationships, outcomes — is the product. This page describes, in plain terms, what we actually do to protect it. We prefer specific practices over vague assurances, so everything below is a statement of fact about how the platform runs today.

1. Encryption in transit

All traffic between your browser and Entwine is encrypted with TLS. Certificates are issued and renewed automatically; expiry is independently monitored so a renewal failure is caught weeks before it could affect you.

2. Payments

Subscription payments are processed entirely by Stripe, a PCI DSS Level 1 certified payment processor. Your card details are entered on Stripe's systems and never touch Entwine's servers — we store no card numbers, in any form.

3. Tenant isolation

Entwine is multi-tenant, and isolation between organizations is enforced in the data layer itself: every query is automatically scoped to your organization by global filters that fail closed, rather than relying on each feature to remember a check. Within your organization, row-level party security and granular permission sets control what each user and each portal partner can see and do. These boundaries are guarded by automated tests that run before every release.

4. Authentication & sessions

Sessions are carried in HttpOnly, Secure cookies — credentials and tokens are never stored in browser storage where scripts could read them. Passwords are stored only as salted one-way hashes (PBKDF2); we cannot read them and never transmit them. Sign-in attempts are rate-limited to blunt credential-stuffing and brute-force attacks (see our Fair Use Policy for how limits are enforced).

5. Documents & files

Uploaded documents live in private object storage, encrypted at rest by our storage provider. There are no public file URLs: downloads are served only through short-lived, signed links generated for an authorized user at the moment of access.

6. Infrastructure & network

Entwine runs on DigitalOcean infrastructure in the United States. Only the HTTPS front door is exposed to the internet — the database, message queue, and internal services are unreachable from outside and speak to each other on a private network. Administrative access requires key-based authentication from named network addresses only. Secrets are injected at deploy time and are never stored in source control.

7. Monitoring, backups & recovery

The platform's health is checked continuously from independent external monitors, on top of internal readiness probes covering the database, background-job system, and file storage. Infrastructure is backed up automatically every week, and the keys the application needs for recovery are additionally backed up off the host.

8. Where we are on certifications

We are an early-stage company and do not yet hold formal certifications such as SOC 2 or ISO 27001 — and we won't imply otherwise. If your organization has a security questionnaire or due-diligence process, we're glad to complete it honestly: contact security@entwineapp.io.

9. Reporting a vulnerability

If you believe you've found a security issue in Entwine, please email security@entwineapp.io with the details. We read every report, will acknowledge yours, and won't take action against good-faith research conducted without harming other tenants' data or service availability.