Esadax Security & Compliance Overview

Esadax is committed to maintaining the highest standards of security, privacy, and compliance. This document outlines the measures we’ve implemented to protect customer data, comply with global regulations, and ensure infrastructure reliability.

Compliance Standards

Esadax aligns with leading industry standards and regulations:

• SOC 2 Type 2: We’ve completed a SOC 2 Type 2 audit, validating that our internal controls are effectively designed and operating as intended.
• ISO 27001:2013: Our Information Security Management System (ISMS) is based on ISO 27001:2013, reflecting a structured approach to managing information security risks.
• GDPR: We comply with the General Data Protection Regulation (GDPR), ensuring lawful, transparent, and secure data processing.
• PCI DSS: Esadax adheres to the Payment Card Industry Data Security Standard to protect cardholder data.
• HIPAA: Measures are in place to ensure compliance with HIPAA requirements for safeguarding health information.

Infrastructure

Our infrastructure is designed with security, scalability, and reliability in mind:

• Cloud Provider: We leverage Amazon Web Services (AWS) for its robust and secure cloud platform.
• Data Centers: Data is replicated across multiple regions for availability and resilience against localized failures.
• Network Security: Firewalls, intrusion detection systems, and encryption are employed to guard against threats.

Security Measures

To ensure the confidentiality, integrity, and availability of data, we implement:

• Encryption: AES-256 for data at rest and HTTPS/TLS 1.3 for data in transit.
• Access Control: Role-based access ensures that only authorized personnel access sensitive systems.
• Backup & Recovery: Regular backups are securely stored and isolated for disaster recovery purposes.

EU-U.S. Data Privacy Framework

Esadax is certified under the EU-U.S. Data Privacy Framework, facilitating compliant data transfers from the EU, UK, and Switzerland to the U.S.

Enterprise Accounts

Enterprise Teams benefit from dedicated, isolated build infrastructure, ensuring separation from Hobby and Pro tiers.

Penetration Testing & Audits

We perform regular third-party penetration testing and maintain ongoing security assessments through:

• Daily code reviews
• Static analysis checks
• Continuous vulnerability scanning

Data Management & Security Summary

Here's a consolidated overview of how we manage and secure customer data:

1. Infrastructure & Regions

   • Operates on AWS across 18 global regions.
   • Uses an Anycast network to intelligently route traffic and minimize latency.
   • Default serverless deployments run in the U.S., with regional options available.

2. Data Storage & Transfer

   • Data resides in various global locations depending on services used.
   • Operates under a shared responsibility model: we secure the infrastructure; customers manage configuration and access.

3. Encryption

   • AES-256 encryption at rest.
   • TLS 1.3 with HTTPS for all data in transit.

4. Backups

   • Hourly backups retained for 30 days and replicated globally.
   • Backups are not user-accessible and are used strictly for internal recovery.

5. Security Practices

   • Includes regular pentests and audits.
   • Enterprise environments are fully isolated from other account types.

6. Uptime & Resilience

   • AWS Global Accelerator and Anycast ensure automatic failover.
   • Multi-region redundancy and resilience testing minimize downtime risk.

7. Customer Responsibilities

   • Customers are responsible for managing their data configurations and external backups, as Esadax backups are internal only.

---

Esadax continuously invests in security, compliance, and infrastructure resilience to protect your data and support business continuity.