Security.
What we do, plainly.
How we protect the platform and your data today, what is still in progress, and how to reach us when you find a problem.
The platform
Isolated control planes
Every Kubernetes cluster gets its own control plane, never shared with another cluster or customer.
Immutable nodes
Node operating systems are replaced on update instead of being changed by hand.
Encrypted at rest
Volumes and object storage are encrypted with AES-256. Connections use TLS.
Private by default
Cluster nodes have no public addresses; outbound traffic leaves through NAT.
The company and your data
A German company
enum GmbH in Cologne, with no US parent and no exposure to the US CLOUD Act.
Data in Frankfurt
Your data stays in a Tier III+ data centre in Frankfurt.
DPA in every contract
A data processing agreement under GDPR is part of every contract.
Open about incidents
Status, incidents and maintenance are public on enumstatus.com.
How we work
Hardware keys for our team
Internal systems need a hardware security key and a VPN. No passwords alone, no SMS codes.
No public management access
Core infrastructure and management interfaces are not reachable from the internet.
Signed code
Every commit is signed. Unsigned commits are rejected.
Least privilege
Team members get only the access they need right now, on encrypted devices.
Certifications.
Named with who holds them.
Regulation.
Support, not a stamp.
No provider makes you GDPR, NIS2 or DORA compliant on its own. What we give you is a German contracting party, data that stays in the EU, a DPA and documented measures for your own assessment.
Found a vulnerability?
Tell us.
We welcome reports from security researchers. Report to security@enum.co, encrypted with our PGP key if you can. You get an automatic confirmation right away. We triage every report within 10 working days and keep you updated by email until it is fixed.
In scope: the enum platform, API and console under enum.co and enum.cloud, and our network edge. Out of scope: social engineering, physical attacks, denial of service and third-party software we do not operate.
Security at enum is led by Max Heyer (Founder) with Roman Zipp (Founding Engineer). Roman's recent research: Shopify checkout hijack campaign
Our promise
- We treat good-faith research as authorised, even where it technically breaks our terms.
- We take no legal action as long as you follow this policy.
- This is a vulnerability disclosure program. We don't pay rewards or bounties and don't keep a hall of fame. We still read every report and fix what is real.
Please
- Only test accounts you own or have written permission for. Stop and report as soon as you see customer data.
- Use no more than two dedicated test accounts in your own name, and name them in your report, for example with an email alias that contains security. Don't share accounts, projects or credentials with other people, including your own team. Sign up with an address you own, not a disposable email service. Don't create throwaway accounts in bulk. We may block them without notice.
- Only create resources under names and domains you control. Don't claim zones, buckets or projects for third-party or enum names.
- List every resource you created in your report. Delete them once we confirm we can reproduce the issue, or after 30 days at the latest. We remove anything left behind.
- Include a working proof of concept with unedited requests and responses, timestamps and your test account or project ID. For flows that depend on the browser, add a screen recording. We close reports we can't reproduce from what you send.
- You may use AI or scanners, but you are responsible for every claim. We close unverified tool output without a detailed reply.
- Fabricated or edited evidence, or testing beyond your stated scope, means we stop processing reports from you.
- One issue per report. Rate severity by demonstrated impact, not worst case.
- Do not affect the availability of our services, and no denial-of-service tests.
- Keep details private until we have fixed the issue and cleared you to publish.
- We only handle reports and follow-ups by email to security@enum.co. We don't answer messages on LinkedIn, other social media, phone or personal addresses.
- Don't ask for status before 10 working days have passed. Follow-ups sent earlier move your report to the back of the queue.
- Don't ask for payment. We don't pay for reports, and asking doesn't change how we handle yours.
- Report vulnerabilities in open source software we run to that project, not to us.
- We close reports that break these rules without a detailed reply.
Not accepted
- Unedited scanner output: TLS/cipher settings, missing headers, SPF/DMARC, banners or versions, directory listings of public files.
- Best-practice suggestions without a demonstrated attack, such as missing CAA records, account lockout or rate limits.
- Behaviour that is documented as by design.
- Attacks whose precondition already gives the attacker the access they claim to gain, for example a compromised origin server, malware on the victim's device, or self-XSS. Privilege escalation and crossing tenant boundaries from a valid account are in scope.
- Retired or unused hostnames with no service behind them.
- Publicly disclosed CVEs in upstream software, reported within 14 days of the advisory.
Security questions?
Talk to us.
For security reviews, questionnaires or audit questions, write to security@enum.co or reach our team directly.