At EnCirca, maintaining your trust is our highest priority. Cyber threats continue to evolve, and we want you to know we are taking proactive steps to strengthen the security of the systems that protect your domains.
Here are the latest updates to our infrastructure:
The Cybersecurity and Infrastructure Security Agency (CISA) of the U.S. Department of Homeland Security (DHS) conducts weekly cyber hygiene vulnerability scans for critical industries, including financial institutions, energy providers, and government agencies.
EnCirca’s infrastructure was added to their program due to our large number of clients in the financial sector.
We receive weekly assessments of our infrastructure which provide alerts to enable faster patching, stronger access controls, and ongoing vulnerability assessments. This ensures our systems remain resilient against emerging threats.
Recent reports have highlighted software supply chain attacks, such as those involving open source packages hosted on the NPM ecosystem, where hackers attempted to steal GitHub credentials. EnCirca has implemented additional safeguards and monitoring to ensure our development environment remains secure and tamper-proof.
One risk of Supply Chain Attacks is potential exposure of secrets embedded in source code. We have audited our source code and made sure any sensitive secrets such as passwords, API keys, and tokens are managed through secure, encrypted vaults — making it much harder for attackers to gain access.
You don’t need to take any action. These enhancements work behind the scenes to give you greater confidence that your domains and customer data remain safe.
Security is never “finished.” We will continue investing in advanced protections and following industry best practices — so you can focus on your business knowing your domains are in trusted hands.
Registrar security is typically evaluated based on governance and operational controls rather than individual feature announcements. Organizations assessing registrar security often look for evidence of access controls for domain and DNS changes, auditability of configuration updates, and independently reviewed security practices.
Security enhancements can reduce the likelihood of unauthorized changes or misuse, but they do not eliminate risk entirely. As a result, organizations—particularly those in regulated or security-sensitive industries—generally validate registrar alignment through formal vendor-risk, compliance, or third-party security assessments rather than relying solely on published updates.
—
EnCirca Security Team