Security

Credentials and encryption

• Every credential you connect (access tokens, API keys, app secrets) is encrypted with AES-256-GCM the moment it arrives, under a data key unique to your business.
• Those data keys are themselves encrypted by a master key held in AWS Key Management Service (hardware-backed). The master key never leaves AWS, and every use of it is logged.
• Each encrypted value is cryptographically bound to your business and to its own record, so it can't be read if copied elsewhere.
• Credentials are write-only in the interface. You and our staff only ever see the last four characters.
• All traffic uses TLS with HSTS. Databases require TLS with certificate verification and accept connections only from our application servers.

Access control

• Accounts are invitation-only, and every account must confirm its email address.
• Era One staff must use two-factor authentication before they can access any client's workspace.
• Each business's data is isolated: every request is checked against the signed-in user's membership.
• Sensitive actions, including every read of a stored credential, are recorded in an audit log with who, when and why.

Least privilege

• Integrations request read-only access by default. Write access is requested only when a service you've agreed to needs it.
• Our application credentials for key management can only encrypt and decrypt, only for ERA ONE, and cannot export, disable or delete keys.
• Uninstalling the ERA ONE app from Shopify, or disconnecting a system, revokes access and deletes the stored token.

Infrastructure

• Hosted on DigitalOcean in the United States, on private networks with firewalls that restrict administrative access.
• Managed databases with automated daily backups and point-in-time recovery.
• Servers are patched automatically, and deployments are automated and reproducible from source control.
• Webhooks from providers (Shopify, Stripe) are verified by signature before they're processed.

Incidents

If we become aware of a security incident affecting your data, we'll notify affected account owners without undue delay, and within 72 hours where the law requires it, with what we know and what we're doing about it.

Reporting a vulnerability

Email security@era-one.com with details. Please give us reasonable time to fix the issue before disclosing it, and don't access other people's data or disrupt the service while testing. We'll acknowledge reports within 3 business days.