Security and privacy at EMPEQ

 

Security is foundational to EMPEQ. Customers trust us with data that can inform operational decisions – so we design our platform, processes, and culture to protect confidentiality, integrity, and availability from day one.

We take a layered approach to security and privacy that combines strong governance, secure engineering practices, and operational controls – so you can adopt EMPEQ with confidence.

Governance

EMPEQ’s security and privacy program is designed to establish clear policies, implement appropriate controls, and continuously validate that those controls are operating as intended.

Our program is guided by these core principles:

1. Least privilege by default
   Access is limited to what’s needed for legitimate business purposes, approved through defined processes, and reviewed regularly.
2. Defense in depth
   We layer preventative, detective, and corrective controls across infrastructure, application, and user access – so no single failure becomes a single point of compromise.
3. Consistency across the organization
   Controls and standards are applied uniformly across systems, environments, and teams to reduce variance and prevent gaps.
4. Continuous improvement
   We iterate on controls over time – improving effectiveness and auditability while reducing friction for customers and internal teams.

Compliance and independent assurance (optional section)
EMPEQ supports customer due diligence with appropriate security documentation and third-party attestations where applicable.

EMPEQ maintains a NIST 800-171 attestation and is actively progressing toward SOC 2 Type II and CMMC 2.0. Reports are available upon request. Requests can be submitted to security@empeq.co.

Data protection

We safeguard customer data through strong encryption practices, secure key management, and tightly controlled access.

Data at rest

Customer data is encrypted at rest using modern encryption standards. Where appropriate, sensitive values may be protected with additional controls (e.g., field-level encryption or tokenization) to reduce exposure even in the event of unauthorized access.

Data in transit

Data transmitted over networks is protected using industry-standard transport encryption (TLS 1.2+). We use secure configuration practices to reduce downgrade and interception risk.

Key and secret management

Encryption keys and application secrets are stored and managed using purpose-built tooling with strict access controls, logging, and rotation practices. Access to sensitive secrets is limited to approved systems and personnel with a verified need.

Data retention and deletion

We support clear retention practices and secure deletion workflows aligned to operational needs and customer requirements.

Product security

EMPEQ builds security into the product lifecycle – from design to deployment.

Secure development lifecycle

We incorporate security review into planning and implementation, including secure coding practices, peer review, and automated checks in the development pipeline.

Vulnerability management

We identify and remediate vulnerabilities through a combination of automated scanning and structured remediation workflows, prioritizing issues based on severity and exposure.

Typical coverage includes:

• Application and dependency scanning (SCA)
• Code analysis (SAST)
• Runtime and endpoint monitoring where applicable
• Periodic external validation (as appropriate)

Incident response

We maintain an incident response process that includes triage, containment, eradication, recovery, and post-incident review – plus customer communications procedures when notice is required.

Enterprise security

We protect EMPEQ’s internal environment with controls designed for modern, distributed teams.

Endpoint protection and device management

Corporate devices are centrally managed to enforce baseline security controls such as disk encryption, strong authentication, screen lock policies, and timely patching.

Identity and access management

Access to internal tools is governed by role-based access controls, strong authentication, and timely provisioning/deprovisioning. Access is reviewed periodically and removed promptly when no longer required.

Vendor and third-party risk

We evaluate vendors using a risk-based approach – considering data access, production integration, and business criticality – then apply due diligence and contractual safeguards proportionate to that risk.

Security training and awareness

We provide security awareness onboarding and periodic training so employees understand threats, responsibilities, and how to report concerns.

Privacy

EMPEQ designs privacy into how we collect, process, and store information.

• We minimize collection to what’s necessary for legitimate business purposes.
• We apply access controls and logging to protect personal and sensitive data.
• We maintain clear internal procedures for privacy requests and customer support.
• We aim to align with common privacy obligations relevant to our customers and markets.

Privacy policy  • Security contact • Report a vulnerability 

Contact our security team

Questions about EMPEQ’s security posture, due diligence, or vendor onboarding?
Contact: security@empeq.co