Security at EnemoAi

EnemoAi is a business adviser, so it holds things businesses care about: their questions, their documents and their money. This page says plainly how we protect them, and how to tell us if you find a problem.

Only verified people, only verified businesses

• Everyone signs in with their WorkPair ID. EnemoAi has no passwords of its own, so there are none to guess, reuse or leak.
• WorkPair verifies each person's identity to IAL2 (the NIST identity-assurance level that checks a real person against government ID) before EnemoAi lets them in.
• A business account opens only when WorkPair confirms the business itself is verified and that the person setting it up is its owner or an admin there. Teammates are invited by their WorkPair ID and must be members of that same business on WorkPair.
• When WorkPair withdraws someone's identity or membership, or they sign out of WorkPair, their EnemoAi sessions end. If WorkPair stops showing a business as verified, its account is put on hold.
• Sensitive actions (handing over ownership, closing the account in the app, adding more than $500 to the wallet, inviting, removing or changing a teammate's role or spending limit) need a WorkPair sign-in from the last 15 minutes.
• Apple TV signs in with a code that a signed-in person approves on their phone or computer, after confirming with WorkPair. Codes last 10 minutes, work once and are stored only as hashes, and wrong guesses are limited. A TV never counts as a fresh sign-in, so sensitive actions always go back to the phone or computer.
• Anyone can end all of their EnemoAi sessions on every device with Sign out everywhere.

Your business's data stays your business's

• Tenant isolation in the database. The tables holding a business's content, wallet, watchlist, invitations and security log are protected by Postgres row-level security, so a query made for one business can't return another business's rows. (Account and sign-in records, such as people and businesses, read-aloud text (kept up to a day, reachable only by an unguessable link), and a few system tasks, such as payments and monitoring, run outside those rules and are checked in the code.)
• Private by default. A person's questions, answers, documents and decisions are private to them, including from the account owner, unless they choose to share. This is enforced by the database too.
• The owner and admins see who spent what from the shared wallet, never what anyone asked.
• Documents you attach for review are deleted automatically after 7 days.
• The owner can close the account in the app: answers, decisions, documents and the Watchlist are deleted, everyone's name, email and WorkPair details are removed, and unused credit is refunded.
• The database is backed up every night, encrypted with a key that is never given to our backup provider, and each backup is permanently deleted after 30 days.
• Card payments are handled by Stripe Checkout; EnemoAi never sees or stores card numbers.

In transit

The site and the API are served only over HTTPS (TLS). Sign-in cookies are HttpOnly and Secure, and every request that changes something must carry a header that only EnemoAi's own pages can send, so other websites can't act on your behalf. Sign-in with WorkPair uses OpenID Connect with PKCE and pushed authorization requests, and EnemoAi checks WorkPair's signatures on every sign-in.

Spending you can predict

Every question is priced before any work starts. Questions above the standard price run only after you approve the quote (or within an automatic-approval limit you set yourself), and nothing ever runs without wallet funds. Each question is priced so its estimated AI model cost is no more than 10.78% of its price, and its AI usage is metered against that budget; if a run goes slightly over, EnemoAi pays the difference.

A security log you can read

EnemoAi keeps an append-only security log for each business: sign-ins and sign-outs, invitations, role and spending-limit changes, removals, ownership handovers, access ended by WorkPair and account closure. The database refuses to edit or delete its entries. The owner and admins can read it in Account; it shows who did what and when, with a shortened network address, and never the content of anyone's questions.

Abuse

Requests are rate-limited per person and per business. Anyone can report a teammate or an answer to EnemoAi staff from inside the app; only EnemoAi staff see who reported whom. A ban applies to the WorkPair identity, so a banned person can't come back under a new EnemoAi account.