ERYX OSYour records are evidence. We protect them like it.
Contractors rely on ERYX OS records in insurance audits and payment disputes, and subcontractors trust us with their business paperwork. Here is how we keep that information private, accurate and in your control.
Protections built into the product
Passkey sign-in, no passwords
Every account signs in with a passkey — Face ID, Touch ID, Windows Hello or a security key. There are no passwords to guess, reuse or phish. Accounts are created only from single-use invitations.
Sessions you control
Sessions end after 30 minutes without activity and after 12 hours at most. You can sign out every other device yourself, and company admins can end a teammate's sessions at once.
Encrypted field by field, file by file
Names, emails, phone numbers, insurance agent contacts and project addresses are encrypted (AES-256-GCM) before they are stored. Every uploaded file is encrypted at rest and fingerprinted so changes can be detected.
Each company walled off
Every table in our database has row-level security. Your company's records can only be read by your company and by contractors you have connected with — enforced by the database itself, not just the app.
Tamper-evident audit log
Every change — uploads, approvals, sharing, sign-ins — is written to an append-only log where each entry is chained to the one before it. Any edit or deletion breaks the chain and is detected.
AI reads, a person confirms
Software reads the policy details from each certificate of insurance, but nothing counts until a person checks and confirms every field. Confirmed policies are locked.
You decide what is shared
Subcontractors choose which contractors see their record. Contractors see confirmed policies and current documents; a W-9 tax form is shared only if the subcontractor turns sharing on.
Your data, exportable
Company admins can download a complete export of their company's records at any time, in a standard format.
SOC 2
ERYX OS is designed to SOC 2 criteria; an independent audit is planned. We are not SOC 2 certified today, and we won't say we are until an auditor has issued a report.
Controls already in place include:
- Written security, access, change, incident, vendor and data-retention policies.
- Recorded access reviews: company admins confirm who has access, and the review is kept as evidence.
- Session management and immediate sign-out when someone is suspended.
- A complete audit trail for every company, plus whole-log integrity checks.
- Exact, reviewed software dependencies and automated security scanning.
Who else handles data
We use a short list of service providers. Each one gets only what it needs. We review this list whenever it changes and at least once a year.
| Provider | Used for | What it receives |
|---|---|---|
| Replit, on Google Cloud | Hosting, database and file storage | All customer data. Encrypted fields and files stay encrypted under ERYX keys. |
| GitHub | Source code and automated testing | Source code only. No customer data. |
| Anthropic | Reading certificates of insurance | Certificate files, only to extract policy details. Not used to train models under Anthropic's commercial terms. |
| Postmark | Sending email (invitations, reminders, notices) | Recipient email addresses and email text. No financial details. |
| SAM.gov (U.S. General Services Administration) | Federal exclusion list lookups | Subcontractor legal business names. |
| California CSLB | Public contractor license data | Nothing. ERYX downloads the state's public license data. |
Found a security problem?
Email security@eryxos.io with what you found and the steps to reproduce it. We'll confirm we received it and keep you updated while we fix it.
While you look, please:
- Use only accounts and data that belong to you.
- Don't run tests that slow down or interrupt the service for others.
- Give us a reasonable time to fix the problem before telling anyone else.
Questions about personal data are covered in our privacy notice.