Security & Trust

Data in transit is protected by TLS 1.2+ (HTTPS everywhere). Data at rest is encrypted by the underlying platform providers using AES-256. Session tokens are signed and scoped to the requesting browser.

Your agency's data lives in a Supabase-managed PostgreSQL database hosted in AWS EU (eu-west-1) by default. Files (document uploads, agency templates) live in Supabase Storage in the same region. Authentication identities are managed by Clerk.

If your procurement team needs a different region, contact us before onboarding — we can provision a dedicated instance for enterprise plans.

• Authentication is handled by Clerk. Sign-in uses email verification; 2FA (authenticator app) is supported and strongly recommended for owner accounts.
• Every database query is scoped by organisation via application middleware and Supabase service-role checks. A counselor cannot read rows from another agency's organisation.
• Owner vs counselor role separation is enforced server-side. Only owners can invite members, change subscription plans, or permanently delete records.

Commission status transitions, payment entries, handovers, and document status changes are logged to the student timeline with actor + timestamp. Designed for UK AQF and Australia ESOS record retention expectations. Audit rows are not user-editable.

Applications moved to the trash are recoverable for 30 days before permanent deletion. Deleted notes are hidden from the timeline UI but retained in the database for audit purposes. Full account deletion (right to erasure under UK GDPR Article 17) is available on request and processed within 30 days.

We share only what each sub-processor needs to provide its service. Full list →

Our DPA, published at /legal/dpa, is incorporated into the Terms of Service and covers the eight Article 28(3) processor obligations, sub-processor notification (30 days advance), and a 24-hour breach-notification commitment to Controllers — stricter than GDPR Article 33's 72-hour authority-notification window. For procurement that requires a counter-signed PDF, email hello@enrollo.io and we'll return a signed copy within one business day.

Production errors stream to Sentry with PII scrubbing configured at the SDK level. We use a three-tier severity model (Critical / Major / Minor, per Incident.io 2026 guidance for small teams). Critical incidents — full outages, auth failure, or confirmed data exposure — trigger a 15-minute public status update and a 24-hour processor-to-controller breach notification to the affected agency, stricter than GDPR Article 33's 72-hour authority-notification window. Runbooks are maintained in-repo.

Live status: enrollo.betteruptime.com →

Supabase Pro point-in-time recovery covers the last 7 days. Daily snapshots are retained for 30 days. We rehearse a restore once per quarter on a staging project to confirm the backups are readable.

If you find a vulnerability, please email hello@enrollo.io before disclosing publicly. We'll acknowledge within one business day and keep you in the loop on remediation. We do not currently run a paid bug bounty but we credit reporters in release notes when they'd like credit.

Enrollo targets WCAG 2.1 AA. See our accessibility statement →

• Privacy policy
• Terms of service
• Data Processing Agreement
• Sub-processor list
• Accessibility statement