Isolation by the database
Every business is a tenant, and PostgreSQL row-level security is set per request. A query cannot see another tenant's rows even if the application code tried.
Security & trust
Built to be trusted with other people's pets.
What the platform does, stated plainly and verifiable in the product. We do not print badges we have not earned.
Card numbers never touch enpet
Stripe collects card details directly in the browser and the terminal. enpet stores a token, never the number.
Private media
Photos, signed agreements and exports sit in a private bucket and are served through short-lived signed URLs.
Backups with point-in-time recovery
Continuous write-ahead-log archiving and scheduled base backups to object storage, on a three-instance database cluster.
Sessions per host, roles per user
Staff, parent and admin surfaces run on separate hosts with host-only cookies; roles and finer permission sets gate every route.
An audit ledger
Append-only, per tenant: who changed what, when — including the owner notifications sent after an incident.
Your data, exportable
Clients, pets, appointments and financials export on paid plans; personal-data requests under data-protection law are always honoured.
Right to erasure, built in
GDPR and CCPA erasure workflows and a consent ledger for cross-provider sharing.
Sub-processors
Who else sees data, and what.
Three, on purpose. Each is wired and reachable in production; nothing configured-but-unused is listed.
| Provider | Purpose | Data |
|---|---|---|
| Stripe | Card payments, saved payment methods, terminal readers | Client name, email, phone, amounts; card data goes to Stripe directly |
| Twilio | SMS delivery and inbound replies | Phone numbers and message bodies |
| Akamai Object Storage | Media and document storage | Pet photos, visit images, signed agreements, exports |
Platform
Where it runs.
Akamai Cloud (Linode Kubernetes Engine), three nodes across hosts, TLS terminated at the edge with automatically renewed certificates, Prometheus monitoring with alert rules on the database and every service.
Accessibility & language
Usable by everyone on the team.
A WCAG 2.1 AA programme with automated checks in the build, keyboard-operable dialogs everywhere, and a published accessibility statement. Staff, parent and client pages in English and Canadian French.
Security and privacy questions: admin@enpet.ai
Questions a diligence team would ask?
Write to us. We answer with what the code does, not with a brochure.