Security

Last updated: August 26, 2026

1. Tenant isolation

Enforced by server-side database rules, evaluated on every read and every write.
Not enforced by the client, and not influenceable by it.
Covered by an automated rules test suite that runs on every change. The suite asserts the negative case: that a member of one workspace cannot reach another workspace's data.

2. Access control

Granted per workspace and per module.
Roles are owner, admin and member. Module access is separate and set per module.
Enforced server-side. A read-only grant cannot be escalated by using a different client.
Privileged actions are written to an immutable audit log.

3. Backups and recovery

Database content and authentication data are backed up automatically, encrypted in transit and at rest, so that customer data survives a mistake and the service can be brought back. Restores are tested on a schedule rather than assumed, and each run leaves a dated record.

Layer	Retention	Protects against
Point-in-time recovery	7 days, minute granularity	Bad writes or deletes found within a week
Daily backups	30 days	Corruption found days to weeks later
Weekly backups	90 days	The long tail
Uploaded file versioning	on	Overwrites
Uploaded file soft delete	7 days	Deletions
Authentication export	Daily, 90 days, encrypted	Loss of accounts and access roles

4. Security reviews

Documentation of the security management system — scope, policy, risk method, control coverage and operating procedures — can be issued as a controlled copy under confidentiality for a customer security review. Request it via support@eptk.cloud.

5. Covered elsewhere

These are published in full in their own documents, and are not repeated here:

Where data is processed — Privacy Policy
Sub-processors and the notice given before a new one begins processing — Sub-processor list and Data Processing Addendum
Contractual terms — Terms of Service

Found a security problem? Report it through the feedback form. It reaches us directly; please do not post exploit details publicly.