Security and data
Learn where EnaFeedback hosts your data, how each customer gets a dedicated stack, what is encrypted or masked, and how long each kind of data is kept.
This article explains how EnaFeedback keeps your data separate, which information is encrypted, what is masked in the admin panel and how long data is kept. It is written for IT, information security and KVKK officers.
Required role
This article is for reference. Maintenance and backup are open to the Owner role only; user management to the Owner and Administrator roles.
A dedicated stack per customer
- Each customer runs on its own application stack. The application server, cache (Redis) and file storage are separate for every organization.
- Each organization has its own PostgreSQL database and database user.
- The infrastructure is hosted on Huawei Cloud, and all traffic passes through Cloudflare over encrypted connections (HTTPS).
- QR, NFC and live display redirects, short links, email and SMS sending, and AI requests pass through ENA Cloud, ENA's central gateway.
Identity and access
- Admin users sign in through Logto, by invitation only. There is no public sign-up; invitations are valid for 7 days.
- With 7 roles and 35 permissions, each user sees only the screens their job needs. The permission matrix is shown read-only on the Roles and permissions screen.
- Field staff sign in with a 4-character personnel code or with Quick sign-in (a passkey) on their saved phone. Sign-in locks after 10 failed attempts in 15 minutes. A staff web session lasts 12 hours.
What is encrypted or hashed
| Information | How it is protected |
|---|---|
| Provider and AI API keys | Encrypted with AES-256-GCM |
| Personnel codes | Hashed with Argon2id; never stored in plain text |
| NFC trust token, live display credential | Only a SHA-256 hash is stored |
| Audit entries | Tamper-evident HMAC-SHA256 hash chain |
Other data (feedback text, contact details and so on) is stored in the database without masking or pseudonymization.
Masking in the admin panel
Masking is display-level only and applies to:
- personnel contact details
- the user list
- team members
- recipients in notification delivery logs
Feedback contact details are not masked
The name, phone and email a visitor leaves are shown in full to anyone allowed to see feedback, including team inbox members. Keep this in mind when you set up resolution teams.
Retention
| Data | Period |
|---|---|
| Visitor uploads never attached to a submission | Deleted after 24 hours |
| Open/abandoned survey sessions | Deleted after 90 days |
| Location session / staff session / display QR ticket | 30 minutes / 12 hours / 30 seconds |
| AI translation rows | Kept indefinitely for legal audit |
| Feedback, hygiene reports, tickets, scan events, IP addresses, audit log, notification delivery logs | No automatic deletion; kept until you delete them, run a factory reset, or the service ends |
- Most deletes are soft deletes: even where the screen says "will be permanently deleted", the record is marked as deleted in the database.
- Visitor photos are re-encoded to WebP on the server.
Cookies
There is no cookie banner because only functional, first-party cookies are used (location session, staff session, visitor language, live display, admin language and the Logto session). There are no Google Analytics or similar analytics or tracking scripts.
Backups
- The database is backed up by the cloud provider's automatic backup and point-in-time recovery.
- A separate database dump is taken before every update.
- The Owner can take a live SQL export at any time from Maintenance and backup.
Limits and honest notes
- ISO 9001 and ISO 27001 certification processes are in progress.
- The product has no SAML/enterprise SSO and no multi-factor authentication.
- Visitor uploads are not virus-scanned; files are checked by their content bytes against the declared type.
Related articles
Can't find what you need?
Our support team can help with anything from setup to reporting.
Branding
Set your organization's primary color, logo, the logo in the center of QR codes and cover images in EnaFeedback's Brand settings.
KVKK compliance
As the data controller, use EnaFeedback in line with KVKK: privacy notices and consent text, contact fields, retention, and handling erasure requests.