Security

Security at Embrs

Last updated: 11/12/2026

Organizations use Embrs to build journeys, publish them, and share them with the people they serve, in the Embrs apps and on journey pages. This page describes how we protect the information they and their participants trust us with. For what we collect and why, see our Privacy Policy. For the companies that process information for us, see our Subprocessors list.

1. Where Embrs runs

  • Database and sign-in: Supabase, on Amazon Web Services in the United States (Northern California).

  • Web app and journey pages: Google Cloud, in the United States (Los Angeles).

  • Media, APIs, and the journey builder: Cloudflare, including Workers, Durable Objects, R2 storage, and Stream. Cloudflare runs on a global network, so some requests are handled in the data center closest to the person using Embrs.

Each of these providers maintains its own independent security certifications, such as SOC 2 and ISO 27001.

2. Encryption

  • Information sent between your device and Embrs is encrypted in transit with TLS.

  • Connections to our database must use TLS. Unencrypted connections are refused.

  • Information we store is encrypted at rest by our hosting providers, including our database, file and media storage, and backups.

3. Who can see what

  • Organizations: Access inside Embrs is enforced in the database itself, so each person can see only what their role in an organization allows. An organization’s journey responses are visible to that organization, not to other organizations.

  • Our team: Only a small number of our team can access production systems, and only as their work requires. Our internal admin tools require multi-factor authentication. Access to reported content is limited to a few people, and every time they open it is logged.

  • AI tools you connect: When you connect an AI assistant to Embrs, you approve it with OAuth and a multi-factor check, and you can see and remove connections at any time.

4. Building and changing Embrs

  • Changes to Embrs are tested in a separate development environment before they reach production. Changes to the production database need the approval of an owner of the company.

  • Production secrets, such as API keys, are kept in our providers’ secret stores.

  • Journey pages and new guest sessions are protected from bots by Cloudflare Turnstile.

5. AI service providers

AI Features send each provider only the content that feature needs. We use these providers’ business services, under which they do not use what we send to train their models. We do not use your content to train AI models. Logs of AI requests are available only to our team and are deleted after 30 days. Details are in section 2.B and “AI Features” in our Privacy Policy.

6. Backups and recovery

Our database is backed up every day, and backups are kept for 7 days. Backups are encrypted and stored by our database provider.

7. Keeping only what we need

We delete information on the schedules in our Data Retention Policy. When an organization deletes its content, or a person deletes their account, it is removed from Embrs as that policy describes, and from backups as they expire.

8. Safety

We check some public content automatically, review what people report to us, and report apparent child sexual abuse material to the National Center for Missing & Exploited Children, as described in our Privacy Policy and Child Safety Standards.

9. If something goes wrong

If we learn of a security incident that affects your information, we investigate it, contain it, and tell the organizations and people affected without undue delay, as the law and our agreements require. Organizations with a Data Processing Addendum are notified within the time it sets.

10. Our service providers

We choose providers that are established in their field, and each is bound by data protection terms. The current list, with what each does and where, is on our Subprocessors page.

11. For organizations

Organizations that need a data processing addendum can ask us at privacy@embrs.com. If your security team has a questionnaire, send it to security@embrs.com.

12. Reporting a vulnerability

If you believe you have found a security problem in Embrs, email security@embrs.com with enough detail for us to reproduce it. Please give us a reasonable time to fix it before you share it, and don’t access or change other people’s information, disrupt Embrs, or use automated scanning that degrades it. We won’t take legal action against research done in good faith under these rules.