Controls

Hosted in the EU

Production runs on Amazon Web Services in the Paris region (eu-west-3). AWS holds ISO 27001 and SOC 1/2/3 certifications.

Network isolation

Services run inside a Virtual Private Cloud with no direct public access.

Continuous monitoring

Infrastructure is monitored continuously, with automated alerts on anomalies.

Encrypted daily backups

Data is backed up automatically every day. Backups are encrypted, tested and kept for a configured retention period.

Annual penetration test

An independent third-party provider runs a penetration test every year.

Secure development

Code is reviewed systematically through pull requests, and dependencies are scanned automatically for vulnerabilities (Dependabot).

Bot protection

The rights request form and the free email finder and verifier are protected by Cloudflare Turnstile. The free tool also has daily limits, per IP address and overall.

Stateless MCP connector

The hosted MCP connector (mcp.enrow.io) relays authenticated requests to the Enrow API on AWS. It keeps neither API keys nor request data, apart from security logs.

Encryption at rest

Stored data is encrypted with AES-256 (native AWS encryption).

Encryption in transit

All traffic uses TLS 1.2 or higher (HTTPS). Unencrypted connections are rejected.

Limited retention

Client data is kept for 90 days at most, technical caches for 48 hours, then deleted automatically and irreversibly.

Export and deletion at contract end

When a contract ends, clients have 30 days to export their data in CSV or JSON. All client data, including copies and backups, is then permanently deleted within a further 30 days, with a written certificate on request.

Early deletion on request

Clients can ask support@enrow.io to delete their data before the 90-day limit. Deletion is done within 5 business days.

Data minimisation

Only the data strictly necessary to provide the service is collected and processed. No sensitive data (GDPR Article 9) is processed.

Client data used only for enrichment

Data sent for enrichment is processed only to provide the service, never for Enrow's own commercial purposes, resale or prospecting files.

Card payments through Stripe

Card data is processed only by Stripe (PCI-DSS certified). Enrow stores no card data and has no access to card numbers.

Least privilege

Access follows a strict role-based model (RBAC): each right is limited to what is strictly necessary.

Multi-factor authentication

Users sign in with email and password; multi-factor authentication is available and recommended.

Password hashing

Passwords are hashed with bcrypt and an individual salt. They are never stored in clear text.

Access logging

User actions are logged (identifier, action, timestamp, IP address). Logs are encrypted at rest, and security logs are kept for 12 months.

Restricted production access

Production access is limited to the two joint managers, and all critical access is protected by multi-factor authentication.

Secure sessions

Sessions use signed JWT tokens that expire automatically, and a CSRF token protects against cross-site request forgery.

Individual accounts

Credentials are personal and may not be shared: each user has their own account. Workspace administrators add and remove users and assign their roles.

Abuse monitoring

Service usage is actively monitored to detect abuse and anomalies, with a graduated response: warning, temporary restriction, then termination.

Confidentiality agreements

Every staff member with access to personal data signs a confidentiality undertaking.

Security awareness training

All staff follow data protection awareness training.

Internal password policy

A robust password policy applies to all internal access.

Data Protection Officer

A designated DPO oversees personal data processing.

Security policy and continuity plan

An information systems security policy and a business continuity plan are kept up to date. Both are available on request under NDA.

Breach notification within 72 hours

Clients are notified of a personal data breach within 72 hours. A breach register is kept up to date.

Regulator and individual notification

Enrow notifies the CNIL within 72 hours of becoming aware of a breach, and informs individuals directly when it is likely to result in a high risk to their rights and freedoms.

Subprocessor contracts

Each subprocessor is bound by data protection obligations equivalent to our DPA.

Liability for subprocessors

Enrow remains fully liable to clients for its subprocessors' compliance with their data protection obligations.

Advance notice of changes

Clients are told about subprocessor changes at least 15 days in advance and can object in writing within 15 days.

Enrichment provider safeguards

Third-party enrichment providers are bound by obligations equivalent to the DPA and are located in the EEA or covered by a GDPR transfer mechanism. Their named list is shared on request to the DPO, under NDA.

Safeguarded transfers

Transfers outside the EEA rely on the EU Standard Contractual Clauses (Decision 2021/914) or an adequacy decision.

Legitimate interest assessment

Enrow's enrichment database relies on legitimate interest (GDPR Article 6(1)(f)). The assessment (LIA) is reviewed at least once a year and on any significant change, and is available from the DPO.

Requests handled in 24 business hours

Access, rectification, erasure, objection and other requests can be made through the online form or to dpo@enrow.io. They are handled within 24 business hours of a complete request and confirmed by email.

Permanent exclusion list

People who object or ask for erasure have their data deleted, including from the cache, and are added to a permanent exclusion list so their data is not collected or processed again, even if it reappears in public sources.

Lawful data sources

Enrichment data comes from public sources, official registers, professional networks, search engines, specialist providers and Enrow's own algorithms. It never comes from data breaches, stolen databases or other unlawful sources.

No automated decisions

Enrow takes no decision based solely on automated processing that has legal effects or significantly affects people. Enrichment data is not used for scoring, credit scoring or hiring decisions.

No sale of customer data

Personal data of clients and users is never sold, rented or made available to third parties. Enrow does not sell or share personal information within the meaning of the CCPA/CPRA.

Adults and professionals only

The service is restricted to people aged 18 or over acting for professional purposes. The enrichment database holds only B2B professional data and does not target minors.

Cookie consent

Apart from strictly necessary cookies, cookies are set only after consent in the banner, which can be changed at any time and is renewed every 12 months. The only exception is the affiliate and referral programme cookies.

DPA part of every contract

The DPA applies from acceptance of the Terms and prevails over them on any matter relating to personal data.

B2B-only use of data

Clients may use enriched data only for B2B prospecting, must have a valid legal basis and must inform the people they contact. B2C prospecting, ad targeting, unauthorised resale and spam are prohibited.

99% availability target

Enrow uses its best endeavours to keep the service available at least 99% of business hours each month (Monday to Friday, 08:00 to 20:00 Paris time, excluding French public holidays). Scheduled maintenance is announced at least 24 hours ahead.

Incidents acknowledged in 4 business hours

Availability incidents reported to support@enrow.io are acknowledged within 4 business hours, and the client is kept informed until they are resolved.

Liability cap

Enrow's liability for direct damages is capped at the amounts paid in the 12 months before the event giving rise to the claim. The cap does not apply to wilful misconduct, gross negligence or data protection breaches that directly caused the damage.

Mutual confidentiality

Both parties keep each other's confidential information secret during the contract and for 3 years after it ends.

Audit rights

Clients can audit Enrow's GDPR and DPA compliance once a year with 30 days' written notice. Enrow may instead provide an independent penetration test report or a completed CSA CAIQ less than 12 months old.

30 days' notice of changes

Changes to the Terms and prices, and material changes to the DPA, the privacy policy or the service, are notified at least 30 days before they take effect.

French law, Paris courts

The Terms and the DPA are governed by French law. Disputes go first to amicable resolution and mediation, then to the exclusive jurisdiction of the Paris courts.

Anti-corruption commitments

Both parties commit to the French Sapin II law and applicable anti-corruption rules. A breach allows the other party to terminate immediately.