Snapshot 144945
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Security and control,
built into every environment
Manage access, secrets, and production policies centrally, outside the development loop. Encore enforces them automatically, so developers can self-serve without weakening security or breaking policy.
Start building
See how it could work for your team.
Book a demo
prod-us-east-1Prod environment
Settings
1AWS RDS Instance(1 database)
orders-prod-aws-rds-4f80bff
us-east-1
CONFIGURATIONEDIT
Instance classdb.t3.medium
Max connections500
Allocated storage20 GiB
Postgres version17.6
DATABASES(1)
orders
No pending changes
Audit trail
Permissions derived from the application
Encore understands which services access each database, topic, bucket, cache, and secret. It generates service-specific IAM policies with only the required permissions and updates them as the application changes.
Infrastructure documentation
Granted access0/20 cells
orders dbusers dbreceiptsorders topicstripe keyorderspaymentsusersnotify
Every other combination stays denied — you never write the policy.
From code to policy, automatically
A service that reads from a bucket gets read access to that bucket and nothing else. No engineer hand-writes the policy, and no service quietly accumulates permissions it stopped needing.
You write
const receipts = new Bucket("receipts");
Encore derives
Encore generates
✓s3:PutObject on receipts
✓s3:GetObject on receipts
○— nothing else —
Credentials never need to enter the repository
Developers reference secrets by name while values remain encrypted and scoped to each environment. In production, secrets can be stored in AWS Secrets Manager or GCP Secret Manager and injected at runtime.This matters for AI-assisted development too: an agent can see that a secret exists, and write code that uses it, without ever being given its value.
Secrets documentation
secret("StripeSecretKey")
productionsk_live_••••••••cloud secret store
stagingsk_test_••••••••cloud secret store
localsk_test_••••••••developer override
Never in your repo, never in a .env you have to share.
Developer self-service within defined controls
Platform teams decide who can access environments, modify secrets, connect cloud accounts, and approve infrastructure changes. Developers can provision what their features need without gaining unrestricted production access.
Role-based access control
Admins, Members, and Viewers with distinct permissions. Custom roles are available as a Pro add-on.
Single sign-on
Organizations can manage access centrally with Google or GitHub SSO, so offboarding removes access.
Infrastructure approval workflows
Require an Admin to approve infrastructure changes before a deploy proceeds, per environment.
Environment-scoped configuration
Secrets and configuration are scoped per environment, so development never reads production values.
Custom network configuration
Set your own IP ranges to peer Encore environments with existing networks and avoid conflicts.
Just-in-time access
Time-limited, audited access to production infrastructure instead of standing credentials. Enterprise.
External secret vaults
Keep secret values in your own vault rather than Encore's. Enterprise.
Admin-controlled cloud accounts
Only Admins can connect or disconnect the cloud accounts that environments deploy into.
From commit to cloud, with a clear audit trail
See the infrastructure changes associated with each deployment, require approval in sensitive environments, and keep a record of permission and configuration changes.
Infrastructure changes shown before they apply
Approval requirements per environment
Every change linked to a commit
IAM and configuration history
Architecture and dependency visibility
Building and testing your app0sSearch logOverviewRaw
Build & test—
Compile5 stepswaiting
Test5 stepswaiting
Provision infrastructure4 changes(4 to create)—
Storage1
Bucket ("receipts")Amazon S3
Security3
IAM role ("orders")Task role for orders
IAM policy ("receipts-writer")s3:PutObject on receipts
Policy attachment ("receipts-writer")Attached to role orders
Deploy release1 change(1 to modify)—
Compute1
Service ("orders")Amazon ECS on Fargate
Your app is liveDeployment to production in your AWS account is complete.https://api.acme.com
Open App
Your cloud, your infrastructure
Production workloads and managed services run in your own AWS or GCP account, not in Encore’s. Security teams keep their cloud console, networking, logs, and provider-native controls, which is the part hosted platforms ask you to give up.
Workloads run in your cloud account
Your VPC, your networking rules
Provider-native logging and monitoring
No proprietary runtime to migrate off
Deploying to your own cloud
your application code
RDSSNS + SQSS3Fargate
Cloud SQLPub/SubCloud StorageCloud Run
Same declarations, provider-native infrastructure on each side.
Make security reviews easier
Encore automates controls commonly required by security and compliance programs, including least-privilege access, secrets management, change approvals, and auditability.Encore is GDPR compliant and offers a DPA, encrypts data with AES-256 at rest and TLS 1.2+ in transit, and maintains a documented security policy suite available under NDA for vendor reviews. Our SOC 2 Type I audit is targeted for Q4 2026, with Type II to follow.
GDPR compliant, DPA available
AES-256 at rest, TLS 1.2+ in transit
Documented policy suite, available under NDA
Subprocessor documentation for vendor reviews
SOC 2 Type I targeted Q4 2026
Security and compliance documentation
Automated controls1/6
Least-privilege accessper-service IAM, generated
Secrets managementencrypted, environment-scoped
Change approvalsper environment
Auditabilitychanges linked to commits
EncryptionAES-256 at rest, TLS 1.2+ in transit
Access reviewsrole-based, MFA enforced
Controls commonly required by security reviews, applied by default.
“What used to take days or weeks of back-and-forth between developers and infra teams is now automated and completed in minutes.”
Josef Sima, Engineering Director at Groupon
3xfaster development speed
90%shorter time to market
See case study
// POWERING DEVELOPMENT AT
Move faster without weakening production controls
Give developers a self-service path to production while security and platform teams retain control over access, configuration, and infrastructure changes.
Get started
brew install encoredev/tap/encore &&
encore app create
Copy
Run in your terminal to get started locally.