Security & Trust

EnvoyEngage is built so that many organizations can share one deployment while their data stays strictly separated. This page summarizes how we isolate, authenticate, and protect data. For how we handle personal data, see our Privacy Policy and DPA.

Tenant isolation

• Database-enforced. Every tenant-scoped table is protected by row-level security, so each request is filtered to the caller’s tenant and organization based on verified identity claims — not on the URL or request input.
• Host-vs-session lock. A signed-in user on a workspace or portal that belongs to a different tenant is denied before any data is rendered.
• Cross-tenant identity independence. The same email used across different tenants resolves to independent, unlinked identities.

Authentication and access

• Native authentication with per-tenant role and organization claims injected into each session.
• Administrative access is role-gated; the platform console is restricted to platform staff.
• Impersonation (where used for support) is scoped and recorded in an audit log.
• Zendesk connections use OAuth where available; access is limited to the scopes needed.

Data protection

• Encryption in transit. Traffic is served over HTTPS/TLS.
• Secrets at rest. Per-tenant Zendesk credentials and OAuth tokens are stored encrypted in a secrets vault and are never exposed to the browser.
• Your system of record. Support data lives in the Zendesk you already operate; EnvoyEngage adds a layer on top rather than becoming a separate store of your tickets.

Infrastructure and sub-processors

The Service runs on established cloud providers. The third parties we rely on are listed on our Sub-processors page.

Reporting a vulnerability

If you believe you’ve found a security issue, please email jakub@goenvoy.co with details. We appreciate responsible disclosure and will work with you to investigate and resolve it.