Trust & Security

All data in transit between the endpoint agent and the EmberHound platform is protected by TLS 1.3. Certificate pinning on the agent side prevents man-in-the-middle interception even on compromised networks.

At rest, findings metadata is encrypted with AES-256. Device authentication tokens are derived using PBKDF2 with SHA-256 and 100,000 iterations, stored as base64(salt):hex(hash). Raw secret material is never persisted.

DSAR subject identifiers are pseudonymised with a per-organisation cryptographic pepper stored in Supabase Vault (pgsodium). Peppers are scoped to a single tenant and are never transmitted to any subprocessor.

Database connections use enforced SSL. Backups are encrypted with provider-managed keys and rotated automatically.

Backup & recovery targets: daily encrypted snapshots with a 7-day retention window. We target a Recovery Point Objective (RPO) of ≤ 24 hours and a Recovery Time Objective (RTO) of ≤ 8 hours for restoration from the most recent snapshot. These targets are aligned with our database provider's Pro-tier backup SLAs; actual recovery times depend on the size and nature of the incident.

EmberHound is architected around a strict zero raw data principle. Sensitive values are redacted on the endpoint before any data leaves the device.

• Credit card numbers are masked to show only the last 4 digits.
• Email addresses show only the first character with a masked domain.
• Masked previews are generated with a 20-character context window, capped at 100 characters, and sanitised for safety.
• A salted SHA-256 fingerprint is computed for deduplication - the original value cannot be reversed.

On ingestion, backend functions reject any payload containing an unmasked PAN (via Luhn check) or raw sensitive data. If it passes validation, only the masked preview and fingerprint are stored.

The EmberHound agent runs entirely on the endpoint device. File scanning, pattern matching, OCR analysis, and data classification all happen locally - the central platform never accesses the file system.

After scanning, only metadata and redacted findings are transmitted. Each agent authenticates using a unique, rotating device token with certificate-pinned connections. Tokens are rotated automatically and previous tokens are revoked.

This architecture ensures that even if the central platform were compromised, no raw sensitive data would be exposed - because it was never transmitted or stored.

Access to data within the platform is governed by five tenant-level roles, each with precisely scoped permissions:

All access rules are enforced at the database layer using Row-Level Security (RLS) policies, ensuring that even direct API access cannot bypass role restrictions.

Each subscription plan defines a configurable retention window (in days). Findings older than the retention period are hidden from standard tenant views but preserved for audit continuity.

• Active accounts: Data is retained according to the plan's retention setting.
• Account closure: All organisation data is permanently deleted within 30 days of account closure.
• Backups: Encrypted backups follow the same retention lifecycle.

EmberHound uses the following third-party subprocessors to deliver the service.

Last updated: 27 August 2026. We notify customers of any subprocessor changes at least 30 days in advance. To subscribe to change notifications, email privacy@emberhound.com.