Your data is our responsibility
We handle sensitive compensation data for your entire sales team. That's a responsibility we take seriously. Here's how we protect it.
Encryption
- All data encrypted in transit using TLS 1.2+
- Data encrypted at rest using AES-256
- Password hashing with bcrypt (salted, high work factor)
- Authentication tokens secured via signed JWTs
Access Control
- Role-based access control (Admin, Manager, Rep)
- Organization-scoped data isolation (multi-tenant)
- No cross-tenant data access by design
- Session management with automatic expiration
Infrastructure
- Hosted on enterprise-grade cloud infrastructure
- Point-in-time recovery for database backups
- Standard platform DDoS protection and firewalls
- Environment isolation (development, staging, production)
Data Privacy
- We do not sell your data — ever
- Customer data is never used for model training
- Minimal data collection — only what's needed to operate
- Data export and deletion available upon request
Application Security
- Input validation and parameterized queries to prevent injection
- CSRF protection built into our framework
- Content Security Policy headers enforced
- Regular dependency auditing and vulnerability monitoring
Incident Response
- Documented incident response plans
- Prompt notification of security incidents affecting your data
- Post-incident reviews and root cause analysis
- Dedicated contact for vulnerability reporting
Report a vulnerability
If you discover a security vulnerability, please report it responsibly. We appreciate your help keeping Earnest and our customers safe.
Email: security@earnestcomp.com
Please allow up to 48 hours for an initial response. Do not publicly disclose vulnerabilities until we've had a chance to address them.