Security and data protection

Every company on Effred One runs in its own walled-off space. EVA works inside those walls with the same permissions as the person asking — and nothing changes until a person confirms.

Last updated 5 October 2026

A database of your own

Each company gets its own PostgreSQL database, its own users, its own branding and its own sub-domain at yourcompany.effred.com. There are no shared tables, so there is no other company’s data to see.

Effred switches products and features on per company and sets caps on employees, storage and users, so each workspace runs only what it has signed up for.

Encrypted, hosted in India

Data is encrypted in transit and at rest, and hosted in India by default.

Enterprise customers can bring their own database: we configure your PostgreSQL during onboarding, and backups stay under your control. Enterprise customers can also choose a region.

One permission engine

Access in Effred One is decided by one permission engine — product, then feature, then action, with field-level rules. Nobody can grant more than they hold.

Roles, departments and Project PINs decide who sees what on every screen, report and dashboard widget. The same rules apply on the phone.

A record of who did what

Every read, write, letter and email is logged for each company. Approvals, changes and every outbound email are recorded with who and when — ready when your auditor asks.

The log can be exported; our Pricing page shows which plans include audit export.

Branded mail identities

Email from Effred One goes out from your company’s own branded addresses — hr@, accounts@, legal@ and service@yourcompany.effred.com. Every outbound email is templated and logged.

EVA guardrails

EVA, the assistant inside Effred One, is an interface on top of the portal, never a way round it.

It runs as the person asking, with their session. It holds no permission of its own, so it cannot see more than you can.
It calls the portal’s own API routes. It never sees a database, a connection string or SQL.
It cannot choose a company — the company is whoever’s portal it is.
It proposes changes on a card. Nothing is saved or sent until the person presses Confirm.
The AI provider key is sealed on the server and used only there.
PAN, Aadhaar, passport, IFSC, card and account numbers are masked before anything reaches a model.
Questions and answers are never stored where a screen could read them.
Record fields and documents are treated as data, never as instructions.

Effred can switch EVA off everywhere at once. Each company sets its own policy — on or off, for everybody or chosen people, which capabilities, a daily limit and retention — and can narrow it further for any person. More on the EVA page.

When our people work with your data

If our team needs to see your data, we sign an NDA first, on request. When we place engineers or specialists with you, the NDA and IP assignment are signed before any access is given — your repositories, your accounts.

This website

Contact form messages travel over an encrypted connection to our info@effred.com mailbox, and questions to EVA on this website are answered through Anthropic’s Claude API. The details are in our Privacy policy.

Reporting a vulnerability

If you believe you have found a security weakness in Effred One or this website, please email info@effred.com with “Security” in the subject line, a description of the issue and the steps to reproduce it.

Give us reasonable time to fix the issue before you tell anyone else.
Do not access, change or delete data that is not yours, and stop as soon as you have shown the problem.
Do not run tests that could harm the service or other people, such as denial-of-service, spam, or social engineering of our staff or customers.

We will reply to let you know we have received your report.

Security questions and reviews

If your security or procurement team needs more detail before working with us, write to info@effred.com. We can sign an NDA first, on request.