Security

• Google Cloud: our database, API servers and background jobs in Mumbai, India.
• Vercel: ecodrix.com and the ERIX console.
• Cloudflare R2: files.

Our API limits how fast requests can come in, so floods and password guessing are slowed down.

• All traffic to ecodrix.com, the console and our API is encrypted with TLS.
• Our cloud providers encrypt stored data at rest.
• The credentials a workspace uses to connect its channels (for example, WhatsApp access tokens) are encrypted with AES-256-GCM before we store them.
• Passwords are stored only as scrypt hashes.

• You sign in with a password, or with Google, GitHub or LinkedIn.
• We do not offer two-factor sign-in yet. Sensitive actions, such as revealing or rotating an API key or setting a password, need a one-time code we email to you.
• Each team member has a role (owner, admin, agent or viewer) that limits what they can see and do. Only owners and admins can export data, and only the owner can delete the workspace.
• Settings → Account → Security shows your signed-in devices; you can sign out one device or all of them.

Many businesses share ERIX. Every record belongs to one workspace, and our data layer limits every database query to the signed-in workspace, so one workspace cannot read another's data.

Only staff on our approved list can use our admin tools, each with a role; read-only staff cannot change anything. Signing in as a workspace to help a customer is limited to our most senior admin role, lasts at most one hour, and every use is logged.

The database is backed up every day at 03:00 IST, and the last 7 backups are kept. Point-in-time recovery lets us restore it to a moment between backups.

We keep server logs for 180 days to investigate problems and incidents. Our systems email our team when errors, failed scheduled jobs or webhook failures need a person. Live status and past incidents are on our status page.

Report security flaws to security@ecodrix.com, with enough detail for us to reproduce them. While testing, do not access data that is not yours and do not disrupt the Service. We will acknowledge your report and work to fix confirmed issues quickly.

If a breach affects a customer's data, we tell that customer without undue delay and within 48 hours of confirming it. We report incidents to CERT-In within 6 hours of noticing them, as Indian law requires, and notify the Data Protection Board and the people affected as the DPDP Act and its Rules require.