Security.
What we do, plainly.
How we protect the platform and your data today, what is still in progress, and how to reach us when you find a problem.
The platform
Isolated control planes
Every Kubernetes cluster gets its own control plane, never shared with another cluster or customer.
Immutable nodes
Node operating systems are replaced on update instead of being changed by hand.
Encrypted at rest
Volumes and object storage are encrypted with AES-256. Connections use TLS.
Private by default
Cluster nodes have no public addresses; outbound traffic leaves through NAT.
The company and your data
A German company
enum GmbH in Cologne, with no US parent and no exposure to the US CLOUD Act.
Data in Frankfurt
Your data stays in a Tier III+ data centre in Frankfurt.
DPA in every contract
A data processing agreement under GDPR is part of every contract.
Open about incidents
Status, incidents and maintenance are public on enumstatus.com.
How we work
Hardware keys for our team
Internal systems need a hardware security key and a VPN. No passwords alone, no SMS codes.
No public management access
Core infrastructure and management interfaces are not reachable from the internet.
Signed code
Every commit is signed. Unsigned commits are rejected.
Least privilege
Team members get only the access they need right now, on encrypted devices.
Certifications.
Named with who holds them.
Regulation.
Support, not a stamp.
No provider makes you GDPR, NIS2 or DORA compliant on its own. What we give you is a German contracting party, data that stays in the EU, a DPA and documented measures for your own assessment.
Found a vulnerability?
Tell us.
We welcome reports from security researchers. Report to security@enum.co, encrypted with our PGP key if you can. We confirm receipt within 48 hours and keep you updated until it is fixed.
In scope: the enum platform, API and console under enum.co and enum.cloud, and our network edge. Out of scope: social engineering, physical attacks, denial of service and third-party software we do not operate.
Security at enum is led by Max Heyer (Founder) with Roman Zipp (Founding Engineer). Roman's recent research: Shopify checkout hijack campaign
Our promise
- We treat good-faith research as authorised, even where it technically breaks our terms.
- We take no legal action as long as you follow this policy.
- Rewards are at our discretion. They go to the first reporter of an original issue that we can reproduce and that has demonstrated impact on an in-scope asset.
Please
- Only test accounts you own or have written permission for. Stop and report as soon as you see customer data.
- Use no more than two dedicated test accounts, and name them in your report, for example with an email alias that contains security or bugbounty. Don't create throwaway accounts in bulk. We may block them without notice.
- Only create resources under names and domains you control. Don't claim zones, buckets or projects for third-party or enum names.
- List every resource you created in your report. Delete them once we confirm we can reproduce the issue, or after 30 days at the latest. If you leave resources behind, you can lose the reward.
- Include a working proof of concept with unedited requests and responses, timestamps and your test account or project ID. For flows that depend on the browser, add a screen recording. We close reports we can't reproduce from what you send.
- You may use AI or scanners, but you are responsible for every claim. We close unverified tool output without a detailed reply.
- Fabricated or edited evidence, or testing beyond your stated scope, ends all rewards for that reporter.
- One issue per report. Rate severity by demonstrated impact, not worst case.
- Do not affect the availability of our services, and no denial-of-service tests.
- Keep details private until we have fixed the issue and cleared you to publish.
Not rewarded
- Unedited scanner output: TLS/cipher settings, missing headers, SPF/DMARC, banners or versions, directory listings of public files.
- Behaviour that is documented as by design.
- Attacks whose precondition already gives the attacker the access they claim to gain, for example a compromised origin server, malware on the victim's device, or self-XSS. Privilege escalation and crossing tenant boundaries from a valid account are in scope.
- Retired or unused hostnames with no service behind them.
- Publicly disclosed CVEs in upstream software, reported within 14 days of the advisory.
Security questions?
Talk to us.
For security reviews, questionnaires or audit questions, write to security@enum.co or reach our team directly.