Tenant-scoped access
Dashboard and admin data paths check the authenticated workspace before reading or changing tickets, knowledge, feedback, integrations, and billing data.
Security controls implemented today
Specific controls, not absolute promises.
No system is mathematically incapable of failure. This page documents controls present in Evnao and clearly states what has not been independently certified.
Controls and boundaries
Tenant boundaryChecked
Inbound signatureVerified
Unsupported claimsExcluded
State remains inspectable
Current technical controls
Encrypted integration secrets
Provider tokens and connected-action headers are encrypted at rest and treated as write-only in the browser.
Verified inbound events
FastSpring, Meta, Telegram, and Brevo webhook paths validate the expected signature or secret before durable processing. Legacy billing records remain isolated behind compatibility-only handlers.
MFA and session controls
Normal users can enable authenticator MFA and backup codes. Admin access uses a separate session boundary, MFA challenge, throttling, and revocation controls.
Outbound request defense
Website imports and connected HTTPS actions apply DNS/IP checks, redirect limits, response bounds, encrypted credentials, and approval for writes.
Scoped public capabilities
Widget visitors receive hashed, expiring ticket capabilities and origin-bound embed tokens instead of access to tenant identifiers alone.
Certification status
Evnao is not currently represented as SOC 2 certified, HIPAA compliant, or covered by a 99.99% uptime SLA. Those require audited operations, contracts, incident processes, and measured evidence beyond application code.
- AI provider
- Google Gemini is the current live generation and embedding provider. Customer messages and selected knowledge context may be sent to it to answer requests.
- Data retention
- Workspace records remain in Evnao’s database until retention or deletion processes remove them. Zero-data-retention is not advertised as active.
- Responsible disclosure
- Report a reproducible issue to security@evnao.com. Do not access another customer’s data or disrupt service.