How Newenz keeps a company's renewal data safe: where it is held, who can see it, how the connections to other systems work, and what we are working towards. For anything not covered here, or a security questionnaire, write to [email protected].
Where the data is held
- Newenz data is held in London, in the United Kingdom, on Supabase (database, sign-in and server functions). The website and app are delivered by Cloudflare.
- Data is encrypted in transit (HTTPS only, with strict security headers) and at rest by our hosting provider.
- Backups are taken by our hosting provider and kept in the same region.
Each company's data is kept apart
- Every record belongs to one company, and the database itself enforces this with row-level security on every table. A person can only ever read the companies they belong to, even if the app were bypassed.
- The browser cannot write most records directly. Changes go through checked database functions that confirm the person's company, role and sign-in strength, and record important actions in the company's audit trail.
Signing in
- Passwords, single sign-on through the company's own identity provider (SAML, for example Microsoft Entra ID or Okta), and two-step login with an authenticator app.
- Two-step login is required for admins and managers, and a company can require it for everyone. A company can require single sign-on for everyone except its admins, so it can never be locked out.
- Sessions end after a period without activity that the company chooses. Invitations can be limited to the company's own email domains.
Roles and the audit trail
- Four roles: admin, manager, CSM and viewer. Viewers cannot change anything. Settings, connections and writing to other systems are for admins.
- The audit trail records sign-in changes, role changes, connections, report loads, approvals, exports, keys for AI assistants and every write to Salesforce.
Connections to other systems
- Salesforce, HubSpot, Microsoft 365, Slack and call recorders are connected by the company's admin through each provider's own sign-in (OAuth). Newenz never sees or stores the passwords for these systems.
- Connection tokens are held in an encrypted vault on our servers and are never sent to a browser.
- Newenz reads by default. Writing anything back to Salesforce is off until a company admin switches it on, and each write is pressed by a person after Newenz shows exactly what will be written.
- A company's AI provider is used with the company's own key, which is held on our servers and never shown again after it is saved.
AI assistants
- People can let an AI assistant (such as Claude, ChatGPT or Copilot) read their company's Newenz figures with a key of their own.
- Only a fingerprint of the key is stored; the key itself is shown once. It reads only that company, stops working when it is revoked, after 180 days, or when its person leaves the company, and is limited to 60 requests a minute.
- An assistant can read, never change, the company's data.
How we build and test
- Every release is tested before it goes live, including automated tests that try to read and change other companies' data and expect to be refused.
- Releases go through an independent security review, and findings are fixed before release.
- Changes to the database are added in order and never rewritten, so every change can be traced.
Certifications
Newenz does not yet hold a SOC 2 or ISO 27001 certificate. We are working towards SOC 2 Type II and will publish the timeline once the audit is booked. Until then we are glad to answer security questionnaires and to walk your team through how Newenz works.
Reporting a problem
If you think you have found a security problem, please write to [email protected] with "Security" in the subject. We reply within two working days and will keep you informed while we fix it.
Data processing
A data processing agreement is available at newenz.com/dpa. Our privacy statement is at newenz.com/privacy.