Built to be trusted by your security team
Cherishu handles employee data, including birthdays, manager hierarchies, and reward redemptions. Here's exactly how we keep it safe — no marketing fog.
Encryption everywhere
HTTPS / TLS 1.2+ for all traffic. Bcrypt for password hashing (cost 10). Database connections always over TLS in production.
Multi-tenant isolation
Every query is scoped by workspace. Workspaces never see each other's data. Even our super admin sees only aggregate stats by default.
Audit log
Every meaningful action — user invited, role changed, reward deleted, redemption fulfilled, plan changed — is logged with actor + timestamp + workspace context.
Hidden super admin
Platform admin lives at /sup-min, never linked from the public app, X-Robots-Tag set to noindex. Login attempts are signed-cookie based, not part of regular Auth.js.
Role-based access
Employee, Manager, HR Admin, Super Admin. Every API route has a role check. No backdoors.
Data residency
All production data lives in AWS Mumbai (ap-south-1). Custom regions available on Enterprise plans.
How we handle data
What we collect
How we store it
What we share with third parties
- Resend — to send transactional emails (we share recipient email + email body)
- Razorpay — to process subscription payments (we share billing email + payment amount)
- Reward providers (Xoxoday/Tremendous/Amazon Incentives/Giftbit) — only when an employee redeems a reward (we share the recipient email + reward SKU)
- Marketplace merchants — only the order details for orders the employee places (recipient name, shipping address, product SKU)
- Slack/Teams/Discord — only the kudos content + sender/receiver names that you opt to push
Account deletion
Compliance roadmap
Spotted something?
Found a security issue? Email security@cherishu.talkytools.com. We respond within 24 hours and confirm fixes via the same channel. We don't have a bug bounty yet — but we do say thank you publicly (with permission).
Need our security paperwork?
DPA · privacy commitment letter · SOC 2 progress · custom MSA — reach out.
Contact security team