Questions · Enrow Trust Center

Security questions54 answers

Export CSV

Data protection12 answers

Is data encrypted at rest?
Yes, with AES-256 (native AWS encryption).
Yes
Is data encrypted in transit?
Yes, with TLS 1.2 or higher. Unencrypted connections are rejected.
Yes
Is data hosted in the EU?
Yes, on AWS in Paris (eu-west-3).
Yes
Do you back up data?
Automatic daily backups, encrypted, tested and validated.
Yes
Do you limit how long data is kept?
Client data: 90 days maximum. Technical cache: 48 hours. When the contract ends, clients have 30 days to export their data; all client data, copies and backups are then deleted within a further 30 days.
Yes
Can we have our data deleted before the end of the retention period?
Yes. Email support@enrow.io and the data is deleted within 5 business days.
Yes
Can we export our data when the contract ends?
Yes. You have 30 days to export your data in CSV or JSON, from the app, through the API or by asking support@enrow.io. A written certificate of deletion is available on request afterwards.
Yes
Is account data deleted when an account is closed?
Registration data is deleted 30 days after an account deletion request. Invoices and billing records are kept for 10 years (legal accounting obligation), support exchanges for 3 years after the last one, and security logs for 12 months.
Partial
Is customer data used for anything other than providing the service?
Only in anonymised form. Data sent for enrichment is never used for Enrow's own commercial purposes, resale or prospecting files. Anonymised and aggregated data, which no longer identifies anyone, may be used to improve algorithms and for statistics.
Partial
Do you process sensitive data (GDPR Article 9)?
No. Enrow collects no sensitive data, and clients must not send any.
No
Do you store payment card data?
No. Card payments are processed only by Stripe (PCI-DSS certified). Enrow has no access to card numbers.
No
Is customer data used to train AI models?
No. Our contract with our AI provider (Anthropic) includes a no-training clause.
No

Access control7 answers

Do you enforce least-privilege access?
Yes, through a strict role-based access model (RBAC).
Yes
Do you support multi-factor authentication?
MFA is available and recommended for all users, but not enforced. Internally, all critical access is protected by MFA.
Partial
How are passwords stored?
Hashed with bcrypt and an individual salt.
Yes
Do you log access to data?
User actions are logged with identifier, action, timestamp and IP address. Logs are encrypted at rest, and security logs are kept for 12 months.
Yes
Is access to production restricted?
Yes, to the two joint managers. All critical access is protected by MFA.
Yes
Are shared accounts allowed?
No. Credentials are personal and each user must have their own account. In team workspaces, an administrator manages users and their roles.
No
Do user sessions expire?
Yes. Sessions use signed JWT tokens with automatic expiry, and a CSRF token protects against cross-site request forgery.
Yes

Application security3 answers

Do you run penetration tests?
Yes, once a year, by an independent third-party provider.
Yes
Do you follow secure development practices?
Code is reviewed systematically through pull requests, and dependencies are scanned automatically for vulnerabilities (Dependabot).
Yes
Are public forms protected against bots?
Yes. The rights request form and the free email finder and verifier use Cloudflare Turnstile, and the free tool has daily limits per IP address and overall.
Yes

Incident response6 answers

Will you notify us of a data breach?
Yes, within 72 hours of becoming aware of it, with the nature of the breach, its likely consequences, the measures taken and the DPO's contact details.
Yes
Do you notify the supervisory authority of breaches?
Yes, the CNIL within 72 hours. Individuals are also informed directly when a breach is likely to result in a high risk to their rights and freedoms.
Yes
Do you keep a breach register?
Yes, recording the facts, their effects and the measures taken to remedy them and prevent recurrence.
Yes
Is your infrastructure monitored?
Continuously, with automated alerts on anomalies.
Yes
Do you commit to an incident response time?
Availability incidents reported to support@enrow.io are acknowledged within 4 business hours. Enrow then uses its best endeavours to resolve them promptly and keeps you informed.
Yes
Do you have a business continuity plan?
Yes. It is kept up to date and available on request under NDA.
Yes

Privacy and compliance10 answers

Are you GDPR compliant?
Yes. Our Data Processing Agreement (GDPR Article 28) is part of every customer contract and applies as soon as the Terms are accepted.
Yes
Do you have a Data Protection Officer?
Yes, Louis Congard. Reach him at dpo@enrow.io.
Yes
How do you handle transfers outside the EEA?
With the EU Standard Contractual Clauses (Decision 2021/914), plus additional measures where needed, or an adequacy decision.
Yes
Do you cover UK, Swiss and Californian privacy laws?
Yes. The DPA and the Terms cover the UK GDPR and Data Protection Act 2018, the Swiss nFADP and the CCPA/CPRA, under which Enrow acts as a service provider for processing done on behalf of customers.
Yes
Do you sell personal data?
Client and user data is never sold, rented or made available to third parties, and Enrow does not sell or share personal information within the meaning of the CCPA/CPRA. Contact data from Enrow's enrichment database is provided only to users of the service, who must use it for B2B prospecting.
No
Can we object to a new subprocessor?
Yes, in writing within 15 days of the notice, which is sent at least 15 days before the change. If no agreement is reached, the objection counts as notice of termination.
Yes
Can we see the full list of data providers?
Technical subprocessors are listed publicly. The named list of enrichment providers is a trade secret: it is shared on written request to dpo@enrow.io, after you sign an NDA.
Partial
Do you use cookies for advertising?
Only with consent. Google Ads, Meta, LinkedIn and X pixels are used for conversion tracking and retargeting once accepted in the cookie banner. Refusing them does not affect access to the website or the service.
Yes
Are non-essential cookies set only with consent?
Analytics, marketing and preference cookies wait for consent, which you can change at any time with the "Manage my cookies" link and which is renewed every 12 months. Affiliate and referral programme cookies are the exception: they are set without consent, and are not used for advertising or profiling.
Partial
Can customers audit you?
Once a year, with 30 days' written notice, on GDPR and DPA compliance. Costs are borne by the customer unless Enrow is in material breach. Enrow may instead provide an independent penetration test report or a completed CSA CAIQ less than 12 months old.
Yes

Data subject rights7 answers

Is the legal basis for your enrichment database documented?
Yes. It relies on legitimate interest (GDPR Article 6(1)(f)), documented in a Legitimate Interest Assessment (LIA) reviewed at least once a year and on any significant change. The LIA is available from dpo@enrow.io.
Yes
Do you answer data subject requests within the legal deadline?
Yes, within 24 business hours of a complete request, shorter than the one-month GDPR deadline. Requests go through the online rights form or dpo@enrow.io. For data processed on a customer's behalf, Enrow informs that customer and acts on its instructions.
Yes
Can individuals opt out of your database?
Yes, at any time. Their data is deleted, including from the cache, and they are placed on a permanent exclusion list so it is not collected or processed again, even if it reappears in public sources.
Yes
Are individuals told that their data is in your database?
Not individually: Enrow relies on the GDPR Article 14(5)(b) exemption, as informing several million professional contacts one by one would involve a disproportionate effort. Instead, it publishes its privacy policy, offers a rights form with a 24-business-hour response, and requires customers to inform the people they contact.
Partial
Is enrichment data collected from lawful sources only?
Yes: public websites and directories, professional networks, official registers, search engines, specialist providers bound by GDPR obligations, and Enrow's own algorithms. Never data breaches, stolen databases or other unlawful sources.
Yes
Do you make automated decisions about individuals?
No decision based solely on automated processing has legal or significant effects on people, and enrichment data is not used for scoring, credit scoring or hiring decisions. Referral rewards are granted automatically; you can ask for a human review at support@enrow.io.
No
Do you process data about minors?
No. Enrow does not knowingly collect data about minors: the service is restricted to adults acting for professional purposes, and the enrichment database holds only B2B professional data. Any data of a minor that is found is deleted immediately.
No

People and organization3 answers

Do employees sign confidentiality agreements?
Every staff member with access to personal data signs one.
Yes
Do employees receive security training?
All staff follow data protection awareness training.
Yes
Do you have an information security policy?
Yes. The information systems security policy is kept up to date and available on request under NDA.
Yes

Legal and contractual6 answers

Do you offer an SLA?
Enrow uses its best endeavours to reach 99% monthly availability over business hours (Monday to Friday, 08:00 to 20:00 Paris time, excluding French public holidays). Scheduled maintenance, force majeure and third-party failures are excluded. The only contractual remedy is a pro-rata credit note if the service is totally unavailable through Enrow's sole fault for more than 5 consecutive business days.
Partial
Is your liability capped?
Direct damages are capped at the amounts paid in the 12 months before the event giving rise to the claim, and indirect losses are excluded. The cap does not apply to wilful misconduct, gross negligence or breaches of data protection obligations that directly caused the damage.
Yes
Is the contract governed by French law?
Yes, both the Terms and the DPA. Disputes go first to amicable resolution (30 days) and mediation (up to 60 days), then to the exclusive jurisdiction of the Paris courts.
Yes
Do your terms include a confidentiality clause?
Yes. Both parties keep each other's confidential information secret during the contract and for 3 years after it ends.
Yes
Will you notify us before changing your terms?
Yes, at least 30 days before changes to the Terms or prices, or material changes to the DPA, the privacy policy or the service, take effect. New prices apply only to new subscriptions, and you can terminate if you disagree with new Terms or a material change to the service.
Yes
Can we terminate at any time?
Yes. Subscriptions have no minimum commitment; termination takes effect at the end of the current billing period, from your account or by email to support@enrow.io. Amounts already paid are not refunded. Custom contracts have their own conditions.
Yes