Trust
Security
is part of shipping.
We hold partner code, data, and ad accounts every day. This page covers how we protect them and how to tell us when something is wrong.
Least access
Every credential is scoped to one person, one project, and the shortest lifetime the job allows.
Your accounts, not ours
Repos, cloud, and ad platforms stay in your name. We work as invited users you can remove in one click.
Plain answers
Ask what we do with your data and get a written answer, not a badge. The list of providers we rely on is public.
In depth
Security practices
What we run across access, data, code, agents, infrastructure, devices, marketing accounts, and incidents.
Access control
Single sign-on and hardware keys on every internal system. Access is granted per project, reviewed monthly, and removed the day an engagement ends.
Data handling
Partner data is classified at intake, encrypted in transit and at rest, and returned or deleted within 30 days of handover.
Application security
Dependencies and secrets are scanned on every pull request. Secrets live in a vault, never in code, and every release passes automated checks.
Agent security
Agents run on scoped, short-lived credentials with spend caps and full logs. They cannot touch production data unless a person approves the task.
Infrastructure
Deployed on major cloud providers with private networking, managed backups, and infrastructure defined in code and reviewed like any other change.
Endpoint security
Company laptops are managed, encrypted, and patched automatically. Partner data does not live on personal devices or in personal accounts.
Marketing accounts
Ad platforms, analytics, and CRMs are reached through partner-owned accounts with role-based permissions and two-factor auth on every seat.
Incident response
A written incident process with named roles. Affected partners hear from us within 72 hours of confirming a breach, with what happened and what changed.
Responsible disclosure
Report a vulnerability
Found a weakness in an Entatan site, product, or venture? Send it through the privacy portal form. It reaches the security lead directly, and you get a reference number to follow up on.
- 01
Submit the report
Open the privacy portal form and choose the security report type. Include the affected URL, steps to reproduce, impact, and any proof you have.
- 02
We acknowledge
You receive a confirmation and a reference number within two business days. We may come back with questions before triage.
- 03
We fix
Confirmed issues are ranked by severity. Critical fixes ship within days; the rest are scheduled and tracked to closure. You hear from us at each step.
- 04
We credit
With your permission we thank you on this page once the fix is live. Researchers who test in good faith and follow the rules below are welcome here.
Ground rules
- Test only Entatan public sites and products you have an account on. Never partner systems or other users' data.
- No data exfiltration, denial of service, social engineering, spam, or physical access.
- Stop as soon as you can demonstrate the issue, and report it before going further.
- Give us 90 days from acknowledgment before publishing details.
Questions
Do you have a SOC 2 report or an ISO certification?
Not yet. Entatan was founded in 2026 and has not completed a third-party audit. We publish our practices here, answer written security questionnaires, and sign a DPA. If a certification is a hard requirement, say so in the brief and we will tell you whether the timing works.
Where is our data stored?
In accounts you own, in the cloud regions you choose. When we host on your behalf during a build we use US regions by default and move the deployment into your account at handover. The subprocessor list shows the categories of providers involved.
Do agents see our production data?
Only when the task needs it and a person approves it. By default agents work in staging with synthetic or masked data, under scoped credentials, with every action logged. Production access is time-boxed and revoked when the task closes.
What happens if there is a breach?
A named lead runs the written incident process. Affected partners are notified within 72 hours of confirmation with what happened, which data was involved, and what we changed. A post-incident review is shared with the partner within two weeks.
Questions before you share access?
Send your security questionnaire or your own requirements through the contact form. We answer in writing, usually within a week.