Security is foundational to how Edirae is built and operated. This page answers the questions teams most often ask before trusting us with their data — clearly, and without jargon.

If your question isn't covered here, email security@edirae.com and we'll get you an answer.

1. Where Your Data Is Stored

Edirae runs on DigitalOcean managed cloud infrastructure (compute, database, and object storage).
Encryption in transit: all traffic is served over HTTPS using TLS 1.2 or higher.
Encryption at rest: databases, backups, and stored files are encrypted at rest.
Production data is isolated from development and staging environments.

Specific data-region details are available on request for teams with residency requirements — contact security@edirae.com.

2. Who Has Access

Production access is restricted to the founder under a least-privilege model.
No third parties have access to your data beyond the subprocessors listed in section 7, each used strictly to operate the service.
Access to production systems requires authenticated, audited credentials.

3. Backups & Disaster Recovery

Automated, encrypted backups of production data are taken on a regular schedule.
Restore procedures are tested periodically to verify backups are usable.
Our infrastructure provider offers redundancy across its managed services to support recovery from failures.

4. Incident Response

If a security incident occurs, our approach is:

Detect — continuous monitoring and error tracking (via Sentry) surface anomalies early.
Triage — we assess scope, severity, and affected data.
Contain & remediate — we stop the issue and fix the root cause.
Notify — affected users are notified without undue delay, in line with applicable law.
Review — we conduct a post-incident review to prevent recurrence.

5. Data Deletion (GDPR-Aligned)

You can delete your account and associated data at any time.
You may also request deletion by emailing privacy@edirae.com.
Upon a verified request, personal data is removed within 30 days, except where retention is required by law.

For full details on what we collect and your rights, see our Privacy Policy.

6. Authentication & Account Security

Token-based authentication with short-lived access tokens and rotated refresh tokens.
Login history tracking with suspicious-login detection on new devices or locations.
Active-session management so you can review and revoke sessions.
Passwords are hashed; we never store them in plain text.

7. Subprocessors

We rely on a small set of trusted third-party providers to operate Edirae. Each receives only the data necessary for its function.

Subprocessor	Purpose	Data Shared
DigitalOcean	Cloud hosting, compute, managed database, and object storage	All application and learning data (encrypted at rest)
Resend	Transactional email delivery	Name, email address, and message content
Sentry	Error monitoring and reliability logging	Error traces and limited technical metadata
Pusher	Real-time notifications and live updates	Account identifiers and event payloads
Stripe	Payment processing	Billing details (handled by the processor; we do not store card numbers)
Polar	Payment processing and merchant of record	Billing details (handled by the processor; we do not store card numbers)
Paystack	Payment processing	Billing details (handled by the processor; we do not store card numbers)
Anthropic, OpenAI, Google (Gemini), DeepSeek, Mistral	AI mentor, evaluation, and learning-content generation	Only the minimum context required per request

AI providers receive only the minimum data required per request, and we do not permit your content to be used to train third-party models.

8. Compliance & SOC 2 Status

We follow SOC 2-aligned security practices across access control, monitoring, and change management.

SOC 2: In progress — Type 1 audit scheduled for Q1 2027.

9. Reporting a Vulnerability

We welcome responsible disclosure. If you believe you've found a security issue, please email security@edirae.com with details and steps to reproduce. Please give us a reasonable opportunity to address the issue before public disclosure.

10. Contact

Our commitment

Security is never "done." We continuously improve our practices as Edirae grows, and we'll keep this page current as that work progresses.