Enterprise-grade security, by default
Security is not a feature at Engage — it's the foundation. From the way we store your data to how we handle access control, every layer is hardened to protect your business and your customers.
Industry certifications
Security Focused
Defence-in-depth architecture with AES-256 encryption, TLS 1.3, role-based access control, and continuous threat monitoring.
Privacy First
Data minimisation by design. We collect only what is needed, store it securely, and never sell or share your data with third parties.
Enterprise Ready
Full audit logs, multi-tenant isolation, RBAC, SSO-ready architecture, and SLA-backed uptime for enterprise workloads.
Infrastructure
Engage runs on AWS infrastructure across multiple availability zones for maximum redundancy and low latency delivery worldwide.
- Multi-region AWS deployment (US, EU, APAC)
- 99.9% uptime SLA with financial credits
- Automated daily backups with 30-day retention
- Point-in-time recovery for databases
- DDoS mitigation via AWS Shield Advanced
- CDN-accelerated API endpoints globally
Data Security
Your data is encrypted in transit and at rest. We use industry-standard algorithms and rotate keys regularly.
- TLS 1.3 encryption for all data in transit
- AES-256 encryption for data at rest
- Encrypted database backups
- No plaintext credential storage — bcrypt hashing
- Role-based access control with least privilege
- API keys scoped by workspace and permission level
Compliance & privacy
Data Privacy
- Data deletion API for user data removal
- Data export for portability
- Minimal data collection policy
- Encrypted storage at rest and in transit
CCPA
- California Consumer Privacy Act compliant
- Opt-out of data sale (we never sell data)
- Consumer rights request portal
- Annual privacy disclosure
WhatsApp Business Policy
- Opt-in only messaging — no cold outreach
- Meta-approved templates only
- Opt-out management built in
- Policy violation detection and alerts
Access Control
- MFA enforcement (TOTP + WebAuthn)
- SSO via Google OAuth and SAML 2.0
- Session management with idle timeout
- IP allowlisting (Enterprise)
Penetration Testing
- Annual third-party pen test by certified firm
- Continuous automated vulnerability scanning
- Bug bounty programme via HackerOne
- Responsible disclosure policy
Incident Response
- 24-hour breach notification SLA
- Dedicated security incident response team
- Post-incident reports published
- 72-hour regulatory notification where required
Have security questions?
Our security team is happy to answer questions, complete vendor security questionnaires, or provide our latest pen-test report under NDA.