Trust

Security at Anvil

Last updated: April 19, 2026

Anvil is the system of record for your revenue pipeline. We treat that responsibility seriously. This page is a plain-English description of the security controls, certifications, and practices that protect customer data. For the contractual version, see our Data Processing Addendum.

Encrypted by default

TLS 1.3 in transit, AES-256-GCM at rest. Keys in hardware-backed KMS with envelope encryption.

Least-privilege access

Zero production access for engineers without an active approved session. MFA + SSO for every admin.

Transparent incidents

48-hour breach notification, public post-mortems for material incidents, live status page.

1. Data protection

Encryption in transit

All traffic between users and Anvil is served over HTTPS with TLS 1.3. We enforce HSTS with a 1-year max-age and are preload-listed. Internal service-to-service traffic is encrypted inside our private network.

Encryption at rest

PostgreSQL, MongoDB, Redis persistence, and object storage are all encrypted with AES-256-GCM. Database backups are encrypted with separate keys and stored in a geographically distinct region.

Key management

Data-encryption keys are wrapped by key-encryption keys held in a hardware-backed KMS. Keys rotate on a defined schedule; no human has plaintext access to DEKs.

Secrets

Application secrets are stored in an encrypted secret store, injected at runtime, never committed to source control. Secret scanning runs on every push.

Tenant isolation

Every row in every tenant-bearing table carries a tenant identifier. Authorisation is enforced at the application layer, and cross-tenant regression tests run on each deploy. Storage paths are namespaced.

Data residency

Customer data is primarily hosted in Hong Kong SAR. Enterprise customers can request EU or US-only residency; contact us for pricing.

2. Authentication & access

End-user auth

Email + password, Google OAuth, and SAML/OIDC SSO (Enterprise). Passwords are Argon2id-hashed with per-user salts. Accounts lock after repeated failed attempts.

MFA

TOTP and WebAuthn/passkeys are supported for all plans. MFA is enforced for OWNER and ADMIN roles.

Sessions

Access tokens are short-lived (15 min) JWTs signed with RS256; refresh tokens are rotating and stored in __Host-prefixed HttpOnly cookies. CSRF is mitigated by double-submit tokens and SameSite=Lax cookies.

RBAC

Built-in roles: OWNER, ADMIN, MANAGER, MEMBER, VIEWER. Permissions are enforced server-side; the UI hides what the user cannot do but does not rely on that for security.

Employee access

Engineers have no standing production access. Break-glass access is time-boxed, requires peer approval, and is fully logged. All access uses hardware security keys and a managed zero-trust proxy.

API keys & webhooks

API keys are scoped, revocable, rate-limited, and hashed at rest. Webhooks are signed with an HMAC secret; timestamps and replay protection are included.

3. Infrastructure security

Network

Cloudflare sits at the edge providing DDoS mitigation, WAF, bot management, and TLS termination. Origin is reachable only through authenticated tunnels — the real IP is not publicly routable.

Segmentation

Services are grouped into trust zones. Inter-service traffic uses service-mesh mTLS where available and private networks elsewhere. Databases have no public ingress.

Hardening

Hosts run minimal, regularly patched base images. Container images are built from distroless bases where feasible and scanned for CVEs on every build. Deployments refuse to ship if CRITICAL CVEs are present.

Configuration management

All infrastructure is defined as code. Drift is detected and flagged. Manual changes are the exception and are peer-reviewed.

Supply chain

Dependencies are pinned and reviewed before upgrade. We subscribe to advisory feeds for each language ecosystem and ship upgrades within agreed SLAs based on severity.

Build pipeline

CI runs in ephemeral runners with minimal permissions. Artefacts are signed; deploys verify signatures before rollout.

4. Secure development

  • Code review required on every change; no self-merges to production branches.
  • SAST, DAST, dependency, secret, and container scanning in CI; findings are triaged and SLA-tracked.
  • Threat modelling for new systems that touch auth, payments, or PII.
  • Annual third-party penetration test (full-scope). Summary available under NDA.
  • Bug bounty / responsible disclosure — see below.
  • Security-champion programme: at least one trained champion per squad.

5. Monitoring & detection

  • Centralised, tamper-evident log storage with at least 1 year retention for security events.
  • Real-time alerting on authentication anomalies, permission escalations, data-export volume spikes, and WAF signals.
  • Sentry for application errors; OpenTelemetry traces and metrics for performance.
  • Database audit logs for administrative and cross-tenant read/write.
  • Weekly review of high-risk audit events by the security team.

6. Incident response

Runbook

Documented procedure with severity tiers, named roles (incident commander, comms lead, scribe), and pre-built communication templates.

24/7 on-call

Rotating engineering on-call. Security incidents page the security lead in addition to engineering on-call.

Notification SLA

Within 48 hours of confirmation of a Personal Data breach, we notify affected customers’ registered security contact per our DPA.

Post-mortems

Material incidents receive a blameless root-cause analysis. Summaries that do not expose other customers are published on the status page.

7. Resilience, backups, and disaster recovery

  • Backups: encrypted daily full + hourly incrementals for PostgreSQL; object storage is versioned and cross-region-replicated.
  • Retention: 35 days rolling. Legal-hold and longer retention available on Enterprise plans.
  • Restore tests: we perform a full database restore to a clean environment at least quarterly and verify data integrity.
  • Targets: RPO ≤ 1 hour, RTO ≤ 4 hours for the primary database. Actual measured figures are available to customers under NDA.
  • Multi-zone: stateless services run active-active across zones. Stateful services fail over automatically with health-check gating.

8. People & vendors

  • Background checks where permitted by law.
  • Signed confidentiality and acceptable-use policy on hire.
  • Annual security-awareness and phishing-simulation training.
  • Managed device posture (disk encryption, screen lock, EDR) required for any device that accesses production.
  • Vendor review before engaging any processor with access to customer data. See the sub-processor list.
  • Joiner / mover / leaver process for access provisioning and revocation.

9. Compliance & certifications

Active

GDPR & UK GDPR

Controller and Processor obligations, SCCs (Module Two), UK IDTA, DPIA support.

Active

HK PDPO

Data User obligations under Hong Kong’s Personal Data (Privacy) Ordinance — our home jurisdiction.

Active

CCPA / CPRA

Service-provider role, no sale or sharing of personal information, honour GPC signals.

Active

PIPL

Standard-contract route for cross-border transfers out of mainland China on Enterprise plans.

Planned Q4 2026

SOC 2 Type II

Observation window opens Q2 2026. Gap assessment complete; remediation in flight.

Planned 2027

ISO 27001:2022

Implementation aligned with the 2022 Annex A controls. Stage 1 audit targeted 2027.

Customers on Enterprise plans can request our SIG-Lite, CAIQ, or vendor questionnaire under NDA.

10. Data retention & deletion

  • Deletion requests from end-users are honoured within 30 days (or faster where required by law).
  • On account termination, data is retained for a 30-day export window, then deleted or anonymised within a further 60 days, per the DPA.
  • Backups that contain deleted data are purged on the standard rotation (≤ 35 days). We do not hand-edit backups.
  • A certificate of deletion is available on request.

11. Responsible disclosure

We welcome reports from security researchers. Please email security@anvilhk.com (forwarded to 738888@proton.me) with:

  • A clear description of the issue and affected asset.
  • Proof-of-concept steps, minimised to avoid touching real customer data.
  • Your name or handle if you would like credit.

We commit to:

  • Acknowledge within 2 business days.
  • Provide an initial assessment within 5 business days.
  • Not pursue legal action against researchers who act in good faith within the scope of our security.txt policy.
  • Credit researchers (with consent) on a hall-of-fame page.

A paid bug-bounty programme is being scoped for 2026. Until it launches, we pay at our discretion for high-impact issues.

12. Status & transparency

  • Live status at status.anvilhk.com.
  • Scheduled maintenance is announced at least 72 hours in advance on the status page.
  • We publish a transparency report annually summarising data-request volumes from law enforcement and government bodies.

13. Contact

All alias addresses currently forward to 738888@proton.me while we complete the corporate mail migration.