Security and control,
built into every environment
Manage access, secrets, and production policies centrally, outside the development loop. Encore enforces them automatically, so developers can self-serve without weakening security or breaking policy.
us-east-1Permissions derived from the application
Encore understands which services access each database, topic, bucket, cache, and secret. It generates service-specific IAM policies with only the required permissions and updates them as the application changes.
Every other combination stays denied — you never write the policy.
From code to policy, automatically
A service that reads from a bucket gets read access to that bucket and nothing else. No engineer hand-writes the policy, and no service quietly accumulates permissions it stopped needing.
const receipts = new Bucket("receipts");
Credentials never need to enter the repository
Developers reference secrets by name while values remain encrypted and scoped to each environment. In production, secrets can be stored in AWS Secrets Manager or GCP Secret Manager and injected at runtime.This matters for AI-assisted development too: an agent can see that a secret exists, and write code that uses it, without ever being given its value.
Never in your repo, never in a .env you have to share.
Developer self-service within defined controls
Platform teams decide who can access environments, modify secrets, connect cloud accounts, and approve infrastructure changes. Developers can provision what their features need without gaining unrestricted production access.
Role-based access control
Admins, Members, and Viewers with distinct permissions. Custom roles are available as a Pro add-on.
Single sign-on
Organizations can manage access centrally with Google or GitHub SSO, so offboarding removes access.
Infrastructure approval workflows
Require an Admin to approve infrastructure changes before a deploy proceeds, per environment.
Environment-scoped configuration
Secrets and configuration are scoped per environment, so development never reads production values.
Custom network configuration
Set your own IP ranges to peer Encore environments with existing networks and avoid conflicts.
Just-in-time access
Time-limited, audited access to production infrastructure instead of standing credentials. Enterprise.
External secret vaults
Keep secret values in your own vault rather than Encore's. Enterprise.
Admin-controlled cloud accounts
Only Admins can connect or disconnect the cloud accounts that environments deploy into.
From commit to cloud, with a clear audit trail
See the infrastructure changes associated with each deployment, require approval in sensitive environments, and keep a record of permission and configuration changes.
- Infrastructure changes shown before they apply
- Approval requirements per environment
- Every change linked to a commit
- IAM and configuration history
- Architecture and dependency visibility
Your cloud, your infrastructure
Production workloads and managed services run in your own AWS or GCP account, not in Encore’s. Security teams keep their cloud console, networking, logs, and provider-native controls, which is the part hosted platforms ask you to give up.
- Workloads run in your cloud account
- Your VPC, your networking rules
- Provider-native logging and monitoring
- No proprietary runtime to migrate off
Same declarations, provider-native infrastructure on each side.
Make security reviews easier
Encore automates controls commonly required by security and compliance programs, including least-privilege access, secrets management, change approvals, and auditability.Encore is GDPR compliant and offers a DPA, encrypts data with AES-256 at rest and TLS 1.2+ in transit, and maintains a documented security policy suite available under NDA for vendor reviews. Our SOC 2 Type I audit is targeted for Q4 2026, with Type II to follow.
- GDPR compliant, DPA available
- AES-256 at rest, TLS 1.2+ in transit
- Documented policy suite, available under NDA
- Subprocessor documentation for vendor reviews
- SOC 2 Type I targeted Q4 2026
Controls commonly required by security reviews, applied by default.
“What used to take days or weeks of back-and-forth between developers and infra teams is now automated and completed in minutes.”
Josef Sima, Engineering Director at Groupon
Move faster without weakening production controls
Give developers a self-service path to production while security and platform teams retain control over access, configuration, and infrastructure changes.
Paste into your coding agent to install Encore and scaffold an app.