Security & trust

Built to be trusted by your security team

Cherishu handles employee data, including birthdays, manager hierarchies, and reward redemptions. Here's exactly how we keep it safe — no marketing fog.

Encryption everywhere

HTTPS / TLS 1.2+ for all traffic. Bcrypt for password hashing (cost 10). Database connections always over TLS in production.

Multi-tenant isolation

Every query is scoped by workspace. Workspaces never see each other's data. Even our super admin sees only aggregate stats by default.

Audit log

Every meaningful action — user invited, role changed, reward deleted, redemption fulfilled, plan changed — is logged with actor + timestamp + workspace context.

Hidden super admin

Platform admin lives at /sup-min, never linked from the public app, X-Robots-Tag set to noindex. Login attempts are signed-cookie based, not part of regular Auth.js.

Role-based access

Employee, Manager, HR Admin, Super Admin. Every API route has a role check. No backdoors.

Data residency

All production data lives in AWS Mumbai (ap-south-1). Custom regions available on Enterprise plans.

How we handle data

What we collect

Names, work emails, optional birthdays + work anniversary dates, kudos messages, reaction emojis, redemption history, and shipping addresses (only when redeeming physical/marketplace rewards). That's it. We do not collect home addresses, phone numbers (unless explicitly provided for shipping), or any sensitive personal data.

How we store it

PostgreSQL database hosted on AWS Mumbai. Daily backups. Point-in-time recovery on Pro+. Database is not exposed to the internet — only the application server can reach it.

What we share with third parties

Only what's needed for the features you turn on:
  • Resend — to send transactional emails (we share recipient email + email body)
  • Razorpay — to process subscription payments (we share billing email + payment amount)
  • Reward providers (Xoxoday/Tremendous/Amazon Incentives/Giftbit) — only when an employee redeems a reward (we share the recipient email + reward SKU)
  • Marketplace merchants — only the order details for orders the employee places (recipient name, shipping address, product SKU)
  • Slack/Teams/Discord — only the kudos content + sender/receiver names that you opt to push
We do not sell data. We do not run ads. We have no analytics or tracking pixels of any kind.

Account deletion

Workspace owners can request full deletion at any time by emailing privacy@cherishu.talkytools.com. We delete all production data within 30 days; backups expire within 90 days.

Compliance roadmap

Cherishu is GDPR-aligned today (data export, deletion-on-request, audit log). SOC 2 Type II is on the roadmap for Q4 2026. ISO 27001 thereafter. Talk to us for the current letter.

Spotted something?

Found a security issue? Email security@cherishu.talkytools.com. We respond within 24 hours and confirm fixes via the same channel. We don't have a bug bounty yet — but we do say thank you publicly (with permission).

Need our security paperwork?

DPA · privacy commitment letter · SOC 2 progress · custom MSA — reach out.

Contact security team