Security & trust
The ones your IT lead, your facility security officer and your insurer ask, answered in one place, including the ones where the answer is "not yet".
Separation
Each customer has their own database schema and their own file store. Serving your site uses a database role that can reach that schema and nothing else — so a missing filter in a query is not one keystroke away from another customer's visitors.
Requests arrive on your hostname and are bound to your schema before any of the product's code runs. The page that comes back carries your colours, read inside your own scope, and nothing is cached between customers.
The account that serves your site can insert audit rows and read them. It cannot update or delete one. The chain is the evidence; the database permissions are the second lock on it.
Getting in
Console accounts can be required to use two-factor sign-in, with an authenticator app and ten recovery codes shown once. A lost phone is a recovery code, then new codes; a lost everything is a reset by an owner, on the record.
Entrant's own staff accounts have no choice: two-factor is required on every one of them, because a staff account is the account that can reach a customer at all.
When we look
Most vendors can read your data whenever they like and you would never know. Here, looking inside a customer's console needs a grant with a reason and an expiry — and the fact that we looked is written into your own audit log, where you can see it, not only into ours.
Between a minute and four hours, decided when it is asked for, and checked against the clock on every single use rather than once at the start. It can be revoked before it runs out, and revoking is immediate.
A reason is typed before the access exists, not afterwards — a field that can be filled in later only records what someone was willing to say once they knew what they had found.
The entry is written into your audit log, inside your own scope, before the access is allowed. If that write fails, the access fails. A record kept only by us would be us marking our own homework.
What that access can see is one read-only health view — whether your chain verifies, how many visits are open, whether a check-in button is collecting no agreement. There is no "sign in as this customer" and no way to write anything.
Where it is held
The hosted service runs in the United States, on a managed Postgres in the same region as the application. Your files are archived nightly, the archive is read back before any older one is removed, and a copy kept off the machine is encrypted or it is not made at all — a plain bucket is refused rather than quietly accepted.
Nothing about a visitor is sent anywhere else unless you switch it on: mail goes out through our mail provider, a text message through the telephone network, a chat card to the chat space you configured. If none of that is acceptable, the on-premises tier is the answer, and it is the same product.
This website
No analytics. No cookies. No session recording, no visitor de-anonymisation, no advertising pixels, no third-party scripts of any kind. The typefaces are served from this domain rather than from a font network. There is nothing to consent to, which is why there is no consent banner.
It is worth checking that claim, on any vendor's site, with the network tab open. We would rather you did.
Not yet
A trust page that only lists strengths is an advertisement. These are the gaps, so you can decide whether they matter to you before you spend an afternoon on us.
We have not been audited against either. What we have instead is on this page and on the record page, and we will say so plainly in any procurement questionnaire rather than implying otherwise.
When there is one, this is where its date and its summary will be, whatever it says.
Contrast is measured automatically on every build, about 330 ratios across every scheme in both themes, and the console's controls all carry accessible names. The signature pad is the shortfall: it captures a handwritten mark, so a visitor who cannot use a pointer cannot sign unaided, and the answer today is that a member of staff completes the check-in. It is written down in our own accessibility notes, not hidden.
The hosted service is a pilot and says so. If your procurement needs those documents before you can sign, tell us early and we will tell you honestly where we are.
Console accounts are email, password and two-factor. Entra ID and Google Workspace sign-in are not built.
Data comes out as CSV and PDF exports today. There is no documented API or webhook for your own systems to call.
Tell us at security@entrant.app. We would rather hear it from you than from a customer, and we will tell you what we did about it.
