Demo data your clients and leadership can trust.
Endcap holds the field data behind your demos: photos, results, and reports across many brands and agencies. When a client or your leadership asks how that data is kept safe, you can point them here. This page sets out the controls in place today, and the work still on our roadmap, in plain terms.
A multi-tenant console with isolation enforced in the database.
The Endcap product is a hosted application served from app.getendcap.com. Because many brands and agencies share one platform, the most important control is keeping every organisation's data separate, which we enforce with PostgreSQL row-level security, at the data layer rather than relying on application code alone.
The controls behind your field data.
These are the security measures running in Endcap today. We have described each one in concrete terms, not slogans.
Multi-tenant isolation by design
Every record is scoped to one organisation, and that separation is enforced in the database itself by row-level security, not just in application code, so one client's data cannot be read across tenants.
Encryption in transit and at rest
All traffic is served over HTTPS with HSTS, so connections to Endcap are encrypted end to end. Data at rest is encrypted using our infrastructure providers' managed encryption.
Authentication and sessions
Sign-in and session management are handled by our managed auth provider. Credentials are never stored by us in plain text, and access is tied to your organisation.
Least-privilege access, by role
Access follows the principle of least privilege. Roles (platform admin, agency admin, campaign manager, rep, and client viewer) are enforced in the database, so people see only what their role allows.
Audit logs
Endcap keeps organisation-level audit logs of activity inside your console, plus platform-level audit logs across the service, so significant actions can be traced after the fact.
Photo handling
Photos captured in the field are kept in a private storage bucket and served only through time-limited signed URLs. EXIF and GPS metadata are stripped from uploads, so location and device details are not carried into stored images.
Encrypted export credentials
When you connect a scheduled export destination, the credentials for that destination are stored encrypted, not in plain text.
API rate limiting
Endcap applies rate limiting to its APIs to reduce abuse and to keep the service stable for everyone.
Where we stand on SOC 2.
We build to SOC 2-aligned controls. A formal SOC 2 Type II audit is planned. We are not yet certified, and we will not claim a certification we do not hold.
If a SOC 2 report or other assurance is a requirement for your team, whether you are a brand or an agency, talk to us and we will share exactly where we are.
UK GDPR and EU GDPR.
Endcap processes personal data on behalf of the brands and agencies that use it. To support UK GDPR and EU GDPR obligations, we make the following available.
- A Data Processing Addendum is available on request from privacy@getendcap.com.
- Our list of sub-processors is kept up to date and available on request.
- How we handle personal data is set out in our Privacy Policy.
- Data at rest is encrypted with provider-managed encryption, and all access is isolated by organisation.
Found something? Tell us.
If you believe you have found a security vulnerability in Endcap, we want to hear from you. Please report it to us directly so we can investigate and fix it.
Email security@getendcap.com with the details and steps to reproduce. Please give us a reasonable opportunity to respond before any public disclosure.
This page describes our current security posture and is provided for information; it is not legal advice and does not form part of any contract.
Run your demos on a platform built to be trusted.
Start a free trial, or talk to us about the security and data-protection requirements your brand or agency needs to meet.