# Security & Compliance — EternalEngine

Enterprise-grade security with tenant isolation, RBAC, audit trails, and encryption — compliant with GDPR, SOC 2, and OWASP ASVS.

Security & Compliance

# Security that never sleeps

Enterprise-grade protection built into every layer. From tenant isolation and encryption to audit trails and compliance frameworks, EternalEngine is engineered so you never have to choose between power and safety.

[Start free](https://app.eternalengineos.io/signup?plan=free&interval=annual)[Request a Demo](https://eternalengineos.io/demo/)

## Compliance status in one place

Policies for SOC 2, GDPR, HIPAA and ISO 27001 with their control counts.

Click to enlargeTrack compliance status in one place.

## Defense in depth, by design

Six pillars of security that protect every byte of your data.

[### Tenant Isolation Every organization's data is completely separated via PostgreSQL Row-Level Security. Cross-tenant access is architecturally impossible. See how it works →](https://eternalengineos.io/features/security-compliance/tenant-isolation/)[### Role-Based Access Control Granular permissions per user role. Admins, managers, members, and viewers each see only what they should. Fully configurable. See how it works →](https://eternalengineos.io/features/security-compliance/role-based-access/)[### Audit Trails Every action logged with who, what, when, and from where. Immutable audit records for compliance and forensic analysis. See how it works →](https://eternalengineos.io/features/security-compliance/audit-trails/)[### Data Encryption AES-256-GCM encryption for sensitive fields at rest. TLS 1.3 for all data in transit. Your data is encrypted end-to-end. See how it works →](https://eternalengineos.io/features/security-compliance/data-encryption/)[### JWT Authentication RS256-signed tokens with automatic key rotation. Secure session management with configurable expiry and refresh policies. See how it works →](https://eternalengineos.io/features/security-compliance/jwt-authentication/)[### API Security Rate limiting, Zod input validation, and parameterized queries. Every API endpoint is hardened against injection and abuse. See how it works →](https://eternalengineos.io/features/security-compliance/api-security/)

## Complete visibility into your security posture

One dashboard to monitor compliance, audit activity, and security health.

Security & Compliance DashboardLive

### Compliance Status

✅

GDPR

Compliant

Last audit: Feb 2026

✅

SOC 2

On Track

Type II in progress

✅

OWASP ASVS

Level 2

214 controls verified

### Security Score

Excellent

### Recent Audit Log

Last 24 hours

| Timestamp | User | Action | Resource | IP Address |
| --- | --- | --- | --- | --- |
| 14:32:01 | sarah@acme.co | UPDATE | Deal #4821 | 192.168.1.42 |
| 14:28:17 | mike@acme.co | READ | Report: Q1 Revenue | 10.0.0.15 |
| 14:15:44 | admin@acme.co | CREATE | User: james@acme.co | 192.168.1.10 |
| 13:58:22 | sarah@acme.co | EXPORT | Contacts CSV | 192.168.1.42 |
| 13:41:09 | admin@acme.co | UPDATE | Role: Marketing Team | 192.168.1.10 |

## Granular role permissions

Define exactly who can do what. Every action is controlled.

| Role | Create | Read | Update | Delete | Export |
| --- | --- | --- | --- | --- | --- |
| Admin | ✓ | ✓ | ✓ | ✓ | ✓ |
| Manager | ✓ | ✓ | ✓ | ✗ | ✓ |
| Member | ✓ | ✓ | ✓ | ✗ | ✗ |
| Viewer | ✗ | ✓ | ✗ | ✗ | ✗ |

## Nine engineering rules, enforced in the build

Every change is checked against these before it can ship. In plain terms: what each one guarantees you.

E01Physics

Deterministic time, tenant isolation, reproducible behavior

E02Determinism

Same inputs always produce same outputs

E03Boundary

Validate all inputs at system boundaries with Zod schemas

E04Invariant

Document and enforce system invariants, fail fast on violation

E05Observability

Structured logging, request tracing, audit writes for all mutations

E06Security

Zero-trust by default, tenant_id from auth only, parameterized queries

E07Evolution

Additive changes only, reversible migrations, versioned contracts

E08Recovery

Idempotent operations, defined rollback paths, graceful degradation

E09Zero Tolerance

No false reports, no skipped verification, truth is non-negotiable

## Security is built in, not bolted on

From the first line of code to every API call, security is woven into the architecture.

1

### Authenticate

RS256-signed JWT tokens verify identity. Automatic key rotation ensures credentials stay fresh.

2

### Authorize

RBAC checks permissions for every action. Row-Level Security ensures data isolation at the database level.

3

### Validate

Every input is validated with Zod schemas. Parameterized queries prevent injection. Rate limits block abuse.

4

### Audit

Every action is logged with structured context. Immutable audit trails provide full forensic traceability.

## Enterprise confidence, built on evidence

Security isn't a feature we added. It's the foundation everything else is built on.

100%

Tenant isolation via PostgreSQL Row-Level Security on every table

AES-256

GCM encryption for all sensitive data fields at rest

214

OWASP ASVS Level 2 security controls verified

24/7

Automated vulnerability scanning with Trivy and dependency audits

### Backup & Recovery

Automated daily backups with defined RTO/RPO targets. Full, incremental, and continuous WAL archiving for point-in-time recovery.

### Vulnerability Scanning

Automated Trivy scanning on every build. Container images, dependencies, and IaC templates are checked for known CVEs.

### Compliance Frameworks

Aligned with GDPR, SOC 2 Type II, and OWASP ASVS Level 2. Continuous compliance monitoring with automated evidence collection.

## Security runs through everything

Every module in EternalEngine inherits the same security architecture. No weak links.

### CRM

RLS on contacts, deals, and activities. Per-tenant data isolation.

### Financial Ops

AES-256 encryption on financial records. Audit trails on every transaction.

### Analytics

Reports respect RBAC. Data never leaks across tenant boundaries.

### AI Assistant

AI operates within tenant context. No cross-tenant data in prompts or responses.

Questions

## Common questions, straight answers.

### Keep exploring

- [Tenant isolation](https://eternalengineos.io/features/security-compliance/tenant-isolation/)
- [Audit trails](https://eternalengineos.io/features/security-compliance/audit-trails/)
- [Role-based access](https://eternalengineos.io/features/security-compliance/role-based-access/)
- [Plans and pricingFree to start; every paid plan has a 30-day free trial.](https://eternalengineos.io/pricing/)

How is my data separated from other customers?

Every table carries a tenant id and Postgres row-level security enforces it, so a query from one account cannot return another account’s rows.

Is data encrypted?

Yes. AES-256 at rest and TLS in transit, with secrets kept out of code and logs.

Is there an audit trail?

Yes. LogLedge records who changed what and when across customer data, and compliance policies for SOC 2, GDPR, HIPAA and ISO 27001 are tracked in one place.

Do you support SSO?

SSO / SAML is included on Business and Enterprise; every plan has role-based access and JWT sessions.

## Run your business from one place.

Five plans, seventeen launch apps, one dashboard. Set up in under 5 minutes — change tiers any time.

[Start free$0 forever • No card • Upgrade any time](https://app.eternalengineos.io/signup?plan=free&interval=annual)[Talk to Sales](https://eternalengineos.io/contact/)

From $0 · Basic $9.95/mo · Save 20% on annual billing · Upgrade or downgrade any time