Security

Last updated: August 25, 2026

EPTK is multi-tenant software: many organisations' production data sits in one system. This page describes the mechanisms that keep it apart, who can reach it, and what happens when data has to be brought back.

Tenant isolation

Enforced by server-side database rules, evaluated on every read and every write.
Not enforced by the client, and not influenceable by it.
Covered by an automated rules test suite that runs on every change. The suite asserts the negative case: that a member of one workspace cannot reach another workspace's data.

Access control

Granted per workspace and per module.
Roles are owner, admin and member. Module access is separate and set per module.
Enforced server-side. A read-only grant cannot be escalated by using a different client.
Privileged actions are written to an immutable audit log.

Backups and recovery

Layer	Retention	Protects against
Point-in-time recovery	7 days, minute granularity	Bad writes or deletes found within a week
Daily backups	30 days	Corruption found days to weeks later
Weekly backups	90 days	The long tail
Uploaded file versioning	on	Overwrites
Uploaded file soft delete	7 days	Deletions
Authentication export	Daily, 90 days, encrypted	Loss of accounts and access roles

Authentication is exported separately. A database restore without it returns data nobody can sign in to see.
Restores are tested, not assumed. The restore procedure runs on a schedule, the time it takes is measured, and each run leaves a dated record.

Security reviews

Documentation of the security management system — scope, policy, risk method, control coverage and operating procedures — can be issued as a controlled copy under confidentiality for a customer security review. Request it via support@eptk.cloud.

Covered elsewhere

These are published in full in their own documents, and are not repeated here:

Where data is processed, including the transfer basis for authentication data — Privacy Policy
Sub-processors and the notice given before a new one begins processing — Sub-processor list and Data Processing Addendum
Reporting a vulnerability — SECURITY.md and security.txt
Contractual terms — Terms of Service