Your data, locked down.
Elir is built for teams that handle sensitive revenue, CRM, and financial data. Security isn't a feature we bolted on — it's how the platform was designed from day one.
Encryption everywhere
All data in transit is encrypted with TLS 1.3 (HTTPS). OAuth credentials and API keys are encrypted at rest using AES-256-GCM before they ever touch disk. We never store tokens in plaintext.
Per-tenant database isolation
Each customer organization gets its own dedicated PostgreSQL database. Your data is never co-mingled with other customers’ data — not in the same table, not in the same database, not even in the same schema.
Modern authentication
Passwords are hashed with argon2id (the current gold standard). Sessions use short-lived JWT access tokens signed with RS256 (2048-bit RSA), paired with secure httpOnly refresh cookies. No session data is stored in localStorage.
Role-based access control
Custom roles with per-page view/edit/none permissions let you control exactly who sees what. System default roles (Admin, RevOps Manager, Marketing Analyst, Sales Manager, Viewer) are created for every new organization.
Dedicated infrastructure
Elir runs on dedicated hardware (not shared cloud VMs) hosted by Hetzner in Falkenstein, Germany (EU). The server is protected by a strict firewall allowing only ports 22 (SSH), 80 (HTTP redirect), and 443 (HTTPS).
Hardened server
Root SSH login is disabled. Password authentication is disabled — key-only access. Automatic security updates are enabled via unattended-upgrades. fail2ban protects against brute-force attacks.
Daily encrypted backups
Full database backups run every night at 03:00 UTC. Backups are compressed and retained for 14 days. Restore has been tested and takes under 5 minutes for the full dataset.
No third-party tracking
We don’t use Google Analytics, Facebook Pixel, Hotjar, or any other third-party tracking scripts on the application. The only cookie we set is a secure, httpOnly authentication token. The landing site sets zero cookies.
Infrastructure overview
| Hosting provider | Hetzner Online GmbH |
| Data center location | Falkenstein, Germany (EU) |
| Server type | Dedicated hardware (not shared VMs) |
| Operating system | Ubuntu 24.04 LTS |
| Database | PostgreSQL 16 with per-tenant isolation |
| TLS termination | Caddy with automatic Let’s Encrypt renewal |
| Credential encryption | AES-256-GCM |
| Password hashing | argon2id |
| Token signing | RS256 (2048-bit RSA) |
| Firewall | ufw — ports 22, 80, 443 only |
| Backups | Daily pg_dumpall, 14-day retention |
| Auto-updates | unattended-upgrades enabled |
Questions?
If you have security questions, need details for a vendor assessment, or want to report a vulnerability, contact us at anatolii@thescimus.com. We respond to security inquiries within one business day.