Security Practices

We take the security of your data seriously. Below are the main technical and organizational measures we use. No system is completely secure, and we can’t guarantee that yours never will be, but we aim for protections appropriate for a service that handles compensation data.

14.1 Encryption

• All data encrypted in transit using TLS 1.2+.
• Data encrypted at rest (AES-256) by our database provider.
• Passwords hashed with bcrypt (salted, high work factor).
• Sign-in sessions use signed tokens that expire automatically.

14.2 Access Control

• Role-based access control (Admin, Manager, Rep) within each organization.
• Each organization’s data is kept separate by the database itself (row-level security), in addition to checks in the application.
• Optional sign-in with Google.

14.3 Infrastructure

• Hosted on infrastructure from providers that hold SOC 2 reports (our hosting and database providers). Earnest itself does not currently hold a SOC 2 report.
• Point-in-time recovery for the database.
• DDoS protection and a firewall provided by our hosting platform.
• Environment isolation (development, staging, production).

14.4 Application Security

• Input validation and parameterized queries to prevent injection attacks.
• Protection against cross-site request forgery on actions that change data.
• Content Security Policy headers.
• Rate limiting on sign-in and data-import endpoints.
• Automated tests, including tests that check one organization cannot see another’s data, and dependency vulnerability checks before we release changes.

14.5 Incident Response

• We have a written incident response process.
• If we confirm a security breach affecting your data, we will notify affected customers without undue delay and as required by applicable law.

14.6 Vulnerability Reporting

If you discover a security vulnerability, please report it responsibly to security@earnestcomp.com. We aim to acknowledge reports within two business days. Please do not publicly disclose vulnerabilities until we have had a reasonable opportunity to address them.