Trust
Trust, line by line
No badge wall. A list of what's in place, what's in progress and what isn't, each with a date where one applies.
| SOC 2 Type II | Not yet | Not yet. Audit scheduled for 2027. We'll replace this line when it's done, not before. |
| GDPR | Done | Article 14 notice published for people in our data. Right to object honoured at any time via /opt-out. EU representative appointed. |
| CCPA / California Delete Act | Done | Registered as a data broker. DROP deletion list pulled every 45 days or sooner. Do-not-sell link in the footer of every page. |
| Texas, Oregon, Vermont data broker registration | Done | Registered where required. The list with registration numbers is on /legal/data-broker-registrations. |
| Encryption | Done | TLS 1.2+ in transit. AES-256 at rest. Keys in a managed KMS, rotated yearly. |
| Hosting | Done | EU and US regions on a major cloud. Sub-processors listed on /subprocessors with the date each was added. |
| Your uploads | Done | CSV uploads are deleted 30 days after the job finishes, or sooner if you delete them. We never add your uploaded contacts to the database. |
| Contact-sharing programmes | Done | None. We don't read inboxes, address books or calendars, and we don't ask for those permissions on Google or Microsoft signup. |
| Penetration test | In progress | Last external test: planned for Q1 2027. Internal review only so far. |
| Bug bounty | Not yet | No formal programme. Report issues to security@heyenrich.io and we'll respond within two working days. |
Documents
The documents a security or legal review usually asks for.
Questions
Security questions go to security@heyenrich.io. Privacy requests from people in the data go through /opt-out, which needs no account and takes about two minutes. Anything else: hey@heyenrich.io.