Security and data
How Ebenstone handles your data.
Plain answers to what a board, an IT director or a vendor review will ask. Each one describes how Ebenstone builds client apps today.
Where your data lives
What your people write stays in your app.
Your app
- On your web address
- Signed in to with accounts you control
- Its own database
- Everything your people write
What your people write is never sent
Ebenstone’s portal
- Usage counts
- Help requests your people choose to send
- Your signed agreements
The details
Nine things that are true of every client app
Your people sign in with accounts you control.
Client apps use your own sign-in system, such as Planning Center, Google Workspace or Microsoft 365. Ebenstone doesn’t create passwords, and you can remove anyone’s access yourself.
Each app has its own database.
Your records are never stored in a database shared with another client.
Ebenstone’s tools show counts, never content.
How many people signed in this week, yes. What any of them wrote, no.
Error logs hold ids and counts.
When something goes wrong, the log records which screen and which record number. It never records what a person typed.
Backups run every day.
Each app’s database is backed up daily.
Hosted in the United States.
The app and its database run in a US data center.
Notices leave out sensitive details.
Emails and calendar entries say only what is safe to see on a lock screen.
Sensitive records need a written addendum first.
Health or student records are covered by a separate signed addendum before any of that data moves.
You’re told if something goes wrong.
The agreement requires written notice of any confirmed unauthorized access to your data, within 72 hours in Ebenstone’s standard terms.
When an agreement ends
Your data is returned or deleted.
On written request, Ebenstone returns your data or deletes it. Your data is your property throughout, and the agreement says so.
What Ebenstone does not claim
Ebenstone has not had its own SOC 2 audit.
Andrew spent years answering SOC 2, HIPAA and GDPR reviews as a vendor. Ebenstone itself is not audited. If your review requires an audit report, say so on the first call.
Have a security questionnaire?
Send it. You’ll get specific answers from the person who builds the system.
or write to [email protected]