Security.
What we do, plainly.
How we protect the platform and your data today, what is still in progress, and how to reach us when you find a problem.
The platform
Isolated control planes
Every Kubernetes cluster gets its own control plane, never shared with another cluster or customer.
Immutable nodes
Node operating systems are replaced on update instead of being changed by hand.
Encrypted at rest
Volumes and object storage are encrypted with AES-256. Connections use TLS.
Private by default
Cluster nodes have no public addresses; outbound traffic leaves through NAT.
The company and your data
A German company
enum GmbH in Cologne, with no US parent and no exposure to the US CLOUD Act.
Data in Frankfurt
Your data stays in a Tier III+ data centre in Frankfurt.
DPA in every contract
A data processing agreement under GDPR is part of every contract.
Open about incidents
Status, incidents and maintenance are public on enumstatus.com.
How we work
Hardware keys for our team
Internal systems need a hardware security key and a VPN. No passwords alone, no SMS codes.
No public management access
Core infrastructure and management interfaces are not reachable from the internet.
Signed code
Every commit is signed. Unsigned commits are rejected.
Least privilege
Team members get only the access they need right now, on encrypted devices.
Certifications.
Named with who holds them.
Regulation.
Support, not a stamp.
No provider makes you GDPR, NIS2 or DORA compliant on its own. What we give you is a German contracting party, data that stays in the EU, a DPA and documented measures for your own assessment.
Found a vulnerability?
Tell us.
We welcome reports from security researchers. Report to security@enum.co, encrypted with our PGP key if you can. We confirm receipt within 48 hours and keep you updated until it is fixed.
In scope: the enum platform, API and console under enum.co and enum.cloud, and our network edge. Out of scope: social engineering, physical attacks, denial of service and third-party software we do not operate.
Security at enum is led by Max Heyer (Founder) with Roman Zipp (Founding Engineer). Roman's recent research: Shopify checkout hijack campaign
Our promise
- We treat good-faith research as authorised, even where it technically breaks our terms.
- We take no legal action as long as you follow this policy.
- We reward valid reports, depending on severity and report quality.
Please
- Only test accounts you own or have written permission for.
- Stop and report as soon as you see customer data.
- Do not affect the availability of our services, and no denial-of-service tests.
- Keep details private until we have fixed the issue and cleared you to publish.
Security questions?
Talk to us.
For security reviews, questionnaires or audit questions, write to security@enum.co or reach our team directly.