India data residency
Primary production runs in a dedicated AWS environment in Mumbai, across two Availability Zones.
Security & Trust
Your sales data stays private, available, and under your control.
Erino runs on Amazon Web Services in Mumbai. Customer data is encrypted in transit and at rest, every organization's workspace is isolated, and access to production is restricted and logged.
Security posture reviewed 16 Sep 2026🇮🇳 AWS ap-south-1 · MumbaiErino Tech Ventures Pvt. Ltd.
Production security postureap-south-1 · erino.io · app · api
0/8
- Zero public database endpoints
private subnets - KMS-backed encryption at rest
AWS KMS · AES-256 - Modern TLS on every endpoint
TLS 1.3 on API - Tenant-isolated workspaces
per-organization - Edge protection
AWS WAF · Shield - Tamper-evident audit trail
CloudTrail · validated - Point-in-time recovery
encrypted · protected - Least-privilege production access
dedicated account
Defence in depth · productionchecking…
Security architecture
Defence in depth, from the edge to the database
Security is designed into every layer of the platform, not bolted on. Each control below runs in production today and is detailed further down this page.
Encrypted in transit
TLS 1.3 preferred on the API, TLS 1.2 floor everywhere, database and cache connections over TLS.
KMS-backed encryption
Database, disks, cache, storage, queues and backups encrypted at rest; secrets with AES-256.
Zero public data endpoints
Database in private subnets with no public IP; cache reachable only from the application.
Point-in-time recovery
Continuous encrypted backups, restorable to any moment in the window, with deletion protection.
Granular access control
Field- and feature-level RBAC, authenticator MFA, strict session cookies, revocable API keys.
Tamper-evident audit trail
Multi-region CloudTrail with log-file integrity validation, VPC flow and ALB logs, alarms.
Edge protection
AWS WAF exploit rules, Shield DDoS protection, rate limiting and locked-down CORS.
How Erino is built
Follow a request from your browser to the database
Erino is a multi-tenant SaaS CRM. Each customer's workspace is logically isolated by organization, and users only see data for the companies and roles they're assigned. Tap any step to see what protects it.
Swipe to follow the path →
🔒
Tap a step
Every hop is encrypted. The dashed area is a dedicated Amazon VPC in Mumbai; the database lives in private subnets with no public IP.
The full stack, layer by layer
| Layer | What we run |
|---|---|
| Web app (app.erino.io) | Static frontend on Amazon S3, delivered by Amazon CloudFront |
| Marketing site (erino.io) | Static site on Amazon S3, delivered by Amazon CloudFront |
| API (api.erino.io) | Application servers behind an HTTPS Application Load Balancer |
| Database | Amazon RDS for PostgreSQL |
| Cache / realtime | Amazon ElastiCache (Valkey), TLS enabled |
| Files, imports, exports, attachments | Amazon S3 |
| Background jobs | Amazon SQS + AWS Lambda (VPC-attached for data-path jobs) |
| Resend (transactional email) | |
| Observability | New Relic + Amazon CloudWatch |
The public API only accepts HTTPS (port 443). TLS is terminated at the load balancer using an AWS Certificate Manager certificate for *.erino.io, with TLS 1.3 preferred and TLS 1.2 as the floor. CloudFront distributions for the app, assets, and marketing site require TLS 1.2 or higher and redirect HTTP to HTTPS. The app and assets origins are reached through CloudFront Origin Access Control, not as open public websites.
Encryption
Readable to your team. Unreadable to everyone else.
Your data is encrypted on the way in, and encrypted where it sits. Flip the switch to see the difference between what your team sees and what's on disk.
Example lead record
NamePriya Sharma
Phone+91 98XXX X4210
StageCounselling · hot
NoteWants weekend batch, fee EMI
Password$2b$12$Qe… (bcrypt hash)
●Illustration. Storage is encrypted with AWS KMS; passwords are bcrypt hashes and can't be recovered, even by us.
🔒PostgreSQL (Amazon RDS)Storage encryption with AWS KMS
🔒Application disks (EBS)Encrypted gp3 volumes with AWS KMS
🔒Object storage (Amazon S3)SSE-S3 (AES-256) on production buckets
🔒Cache (ElastiCache / Valkey)Encryption at rest
🔒Job queues (Amazon SQS)SQS managed server-side encryption
🔒Database backups / snapshotsEncrypted
#Passwordsbcrypt hashes — we cannot recover a user's password
#API keysStored as hashes; only the customer sees the raw key at creation
🔒OAuth / provider tokens, TOTP secrets, webhook credentialsEncrypted at rest with AES-256
Customer-data buckets (files, email attachments, imports, exports) have Amazon S3 Block Public Access enabled. Customer-data storage is never publicly accessible.
- 1All public endpoints use HTTPS.
- 2CloudFront and the API load balancer enforce modern TLS (1.2 minimum; 1.3 on the API).
- 3The application connects to Amazon RDS over TLS.
- 4ElastiCache has encryption in transit enabled.
- 5Integration credentials, OAuth tokens, and similar secrets are stored encrypted (AES-256) — never in plaintext.
Access control
The right people see the right data. Nobody else.
Your admins decide who sees what inside your workspace. On our side, production access is locked down, least-privilege, and logged.
Your team You control
- Organization-managed accounts. Users are invited by an admin. Access is scoped to a tenant and company.
- Role-based access control. Permission templates control what each user can view, edit, or administer, including field- and feature-level rules.
- Authenticator MFA (TOTP). Authenticator-app MFA with rate-limited verification and AES-256 encrypted TOTP secrets.
- Secure sessions. Access and refresh tokens are stored in HttpOnly, Secure, SameSite=Strict cookies in production, bound to issuer and audience.
- API keys. Customers can issue API keys for integrations. Keys are hashed at rest and can be revoked.
- You control connectors. Call, WhatsApp, ads, and portal integrations only process data after your team connects them.
Our team Locked down
- Production runs in a dedicated AWS account.
- The database is not assigned a public IP and is not internet-reachable.
- Redis/Valkey accepts traffic only from the application security group, not from the internet.
- Application data-path Lambdas run inside the VPC.
- AWS API activity is recorded in a multi-region CloudTrail trail with log-file integrity validation.
- Secrets and cloud credentials are not stored in source control.
- We follow least-privilege operational access. Erino employees do not use customer workspaces for anything other than support you request, platform operations, or security investigation.
Role-based access, in practiceExample permission template
CapabilityViewEditAdmin
Own leads
Team's leads
Deal value field
Exports
Users & API keys
Authenticator MFA (TOTP)Example code
- Works with any authenticator app
- MFA verification is rate-limited
- TOTP secrets encrypted with AES-256
Network & application protection
Layers of defence between the internet and your data
Requests have to get through every ring before they reach your workspace. Malicious scanner and exploit paths are stopped at the edge.
0legitimate requests served
0scanner & exploit paths blocked
- Dedicated VPCPublic and private subnets across two Availability Zones in Mumbai.
- Private databaseDatabase in private subnets. NAT Gateway for private-subnet egress.
- HTTPS-only entryInternet-facing Application Load Balancer, HTTPS only.
- AWS WAFOn the API load balancer, including rules that block common scanner and exploit paths.
- AWS Shield StandardOn CloudFront and the load balancer (default DDoS protection).
- Rate limitingApplication rate limiting on public APIs.
- Locked-down CORSCORS restricted to the Erino frontend origin.
- Network telemetryVPC flow logs on the production VPC. ALB access logs written to encrypted S3.
- Secrets never reach logsSensitive fields (passwords, tokens, cookies, API keys) are redacted from application logs.
Backup, recovery & availability
Built to recover to the minute
Continuous, encrypted backups with point-in-time recovery and deletion protection. Drag the marker to pick a moment and simulate a restore.
Point-in-time recovery● Encrypted · continuous
—
Restore point selectedAny minute within the backup window
What this means in practice: if a record is deleted or a database is damaged, we restore from encrypted backups to the exact moment before it happened, not just the last nightly snapshot.
EngineAmazon RDS for PostgreSQL 17
BackupsAutomated, continuous and encrypted
RecoveryPoint-in-time recovery enabled
ProtectionDeletion protection is on
MonitoringPostgreSQL logs shipped to CloudWatch; enhanced monitoring enabled
99.9Amazon S3 design durability (11 nines) for your files, attachments, imports and exports, stored encrypted with public access blocked
Enterprise options: extended backup retention and documented RPO/RTO commitments are available in a DPA or order form.
Logging, monitoring & incident response
Everything is recorded. Secrets never are.
Infrastructure activity, network traffic and application health are logged continuously. Sensitive fields are redacted before anything is written.
Illustration of log types and redactionhover to pause
CloudTrailMulti-region management-plane audit log, with log-file validation, stored in a private encrypted S3 bucket
VPC flow logsNetwork telemetry for the production VPC
ALB logsAccess logs stored in encrypted S3
App logsNew Relic and CloudWatch
AlarmsCloudWatch alarms on production health
If we become aware of a security incident that affects customer data, we will investigate, contain, and notify affected customers as required by law and by contract. Report suspected issues to support@erino.io.
Product privacy defaults
Private by default, not by request
Details are in our Privacy Policy.
₹We do not sell personal data.
Not to advertisers, not to data brokers, not to anyone.
⚖Processor of your CRM data
Erino is a processor of the CRM data you put in your workspace, and a controller of account, billing, and website data.
#Passwords are hashed
They are never stored in plaintext.
↺Revocable integrations
Facebook / Google lead integrations follow Meta Platform policies and the Google API Services User Data Policy (Limited Use). OAuth tokens are encrypted and can be revoked.
⌖No background location
The mobile app only collects location when your organization enables check-in/check-out or location fields, and the user grants permission. Location is not collected in the background.
⌫Deletion on request
You can request account or data deletion via your admin or support@erino.io.
Data residency
Your CRM data lives in India
Primary CRM application data — database, files, job queues, cache — is stored in AWS Asia Pacific (Mumbai). Supporting services outside India are limited, purpose-bound and listed below.
Mumbai · ap-south-1
US sub-processors
CDN edges
Primary dataLimited processing
Stored in Mumbai
The database, files, job queues and cache for your workspace.
DatabaseFilesJob queuesCache
AI
OpenAIOnly if you use Erino AI features (insights, suggested stages, and similar)
✉
ResendTransactional email (invites, verification, product email)
◎
New RelicApplication monitoring
⇄
Amazon CloudFrontGlobal CDN edge locations for the website and app
Need a written transfer assessment or a DPA with sub-processor restrictions? Email support@erino.io.
Sub-processors
Every third party, listed in the open
Third parties Erino uses to operate the service. Each processes data only as needed to provide its function. We keep this list current, and material changes to core sub-processors will be reflected on this page.
| Sub-processor | Purpose | Data involved | Location |
|---|---|---|---|
| Amazon Web Services, Inc. | Hosting, database, storage, CDN, queues, logs | CRM data, files, logs, backups | Primary: Mumbai CDN edges global |
| Resend | Transactional email | Name, email, invite/verification content | United States |
| New Relic, Inc. | App performance & error monitoring | Logs, error traces, limited request metadata | United States |
No match in this list.
| Sub-processor | Purpose | When it applies |
|---|---|---|
| OpenAI, L.L.C. | AI insights and related generative features | When your workspace uses Erino AI features |
| Expo / APNs / Google FCM | Mobile push notifications | When users install the mobile app and allow notifications |
| Slack Technologies, LLC | Internal ops alerts | Erino operations only, unless you connect Slack yourself |
| Meta Platforms, Inc. | Website ad pixel; optional Lead Ads / Login | Marketing site visitors, and/or if you enable the Meta integration |
| Google LLC | Google Ads lead forms; Google Maps Places | Only if you enable those integrations |
No match in this list.
These process data only when you connect them, usually with your credentials. They're your vendors, not Erino's default processors.
WhatsApp / messaging
AiSensyWhatsMarketingEngage (MCUBE)Gupshup
Calling
CloudConnectSmartflo (Tata Tele)CANSVoitekkMcubeExotelKnowlarityAmeyoOzonetel
Lead sources
MetaGoogle AdsIndiaMartNoBroker99acresMagicBricksHousing.comCommonFloorOLXQuikrHomesJustLeadsZoho SalesIQForminatorContact Form 7TownScriptAllEvents
Automation
ZapierPabbly
Other
SlackCalendlyPayURazorpayJustPay
No match in your integrations.
Your responsibilities
The shared-responsibility model
Like every enterprise cloud platform, security works on a shared-responsibility model. Erino secures the platform; your admins control who gets in and what they connect.
Erino takes care of
- Hosting in a dedicated AWS account in Mumbai
- Encryption in transit and at rest
- Isolating your workspace from other customers
- A private database with no public IP
- Encrypted backups with point-in-time recovery
- WAF, DDoS protection and rate limiting
- Audit logging and production monitoring
- Investigating, containing and notifying on incidents
✓Your team takes care of
Your checklist0%
Compliance & security reviews
Built to pass your security review
Procurement and IT teams get the documentation they need, fast. Ask for anything below and we'll send it.
Built for Indian data-protection expectations
We design the platform with Indian data-protection expectations in mind, including the Digital Personal Data Protection Act, 2023, and we act as a processor of customer CRM data under our Privacy Policy and, where executed, a Data Processing Addendum.
DPDP
2023
2023
Digital Personal Data Protection Act, 2023Designed with its expectations in mind · processor under Privacy Policy and DPA
Enterprise customers can request
Found a security issue? Tell us.
If you believe you've found a security issue in Erino, email us with a description and steps to reproduce. We'll acknowledge valid reports and work to fix confirmed issues.
- ✓Send a description and steps to reproduce
- ✕Please don't access other customers' data
- ✕Don't run destructive testing
support@erino.ioReportSecurity principles we build by
- Defence in depth. Edge, network, application and data layers each enforce their own controls.
- Least privilege. Production access is restricted, purpose-bound and logged.
- Encryption by default. In transit and at rest, with keys managed by AWS KMS.
- Isolation by design. Every organization's workspace is logically isolated.
- Auditability. A tamper-evident trail of infrastructure activity, retained in encrypted storage.
Security FAQ
Questions security teams ask us
Something not covered? Email support@erino.io and we'll answer in writing.
Where is my Erino data stored?
Primary CRM application data, including the database, files, job queues and cache, is stored in AWS Asia Pacific (Mumbai, ap-south-1). A few sub-processors such as OpenAI (only if you use Erino AI features), Resend, New Relic and CloudFront edge locations operate outside India.
Is my data encrypted?
Yes. All public endpoints use HTTPS with TLS 1.2 as the minimum and TLS 1.3 preferred on the API. The database, application disks, file storage, cache, job queues and backups are encrypted at rest. Passwords are stored as bcrypt hashes, API keys as hashes, and OAuth tokens and similar secrets with AES-256.
Can Erino employees see my CRM data?
Erino follows least-privilege operational access. Employees do not use customer workspaces for anything other than support you request, platform operations, or security investigation. Production runs in a dedicated AWS account and AWS API activity is recorded in a multi-region CloudTrail trail.
Is my workspace separated from other customers?
Yes. Erino is a multi-tenant SaaS CRM and each customer's workspace is logically isolated by organization. Users only see data for the companies and roles they are assigned.
What happens if data is deleted by mistake?
The database has automated, encrypted backups with point-in-time recovery, so it can be restored to any point within the backup window, not just the last daily snapshot. Deletion protection is on, and extended retention is available for enterprise customers.
Does Erino sell personal data?
No. Erino does not sell personal data. Erino is a processor of the CRM data you put in your workspace and a controller of account, billing and website data, as described in the Privacy Policy.
Can Erino support our security and procurement review?
Yes. Enterprise customers can request a security questionnaire response, a Data Processing Addendum, a current sub-processor list, or a coordinated vulnerability disclosure or scheduled pentest by emailing support@erino.io.
How do I report a security vulnerability?
Email support@erino.io with a description and steps to reproduce. Please don't access other customers' data and don't run destructive testing. Erino acknowledges valid reports and works to fix confirmed issues.
Security review
Bring your security team. We'll bring the answers.
Send your security questionnaire, DPA or pentest request, or walk through the architecture with us live on a call.
Erino Tech Ventures Pvt. Ltd.4th Floor, The Hub, Raj Serenity Evolve Workstudio
Begur Hobli, Yelenahalli Village
Bengaluru, Karnataka 560068
support@erino.io
Begur Hobli, Yelenahalli Village
Bengaluru, Karnataka 560068
support@erino.io