# Security and privacy at EMPEQ

Security is foundational to EMPEQ. Customers trust us with data that can inform operational decisions – so we design our platform, processes, and culture to protect confidentiality, integrity, and availability from day one.

We take a layered approach to security and privacy that combines strong governance, secure engineering practices, and operational controls – so you can adopt EMPEQ with confidence.

**Governance**

EMPEQ’s security and privacy program is designed to establish clear policies, implement appropriate controls, and continuously validate that those controls are operating as intended.

Our program is guided by these core principles:

1. **Least privilege by default**  
   Access is limited to what’s needed for legitimate business purposes, approved through defined processes, and reviewed regularly.
2. **Defense in depth**  
   We layer preventative, detective, and corrective controls across infrastructure, application, and user access – so no single failure becomes a single point of compromise.
3. **Consistency across the organization**  
   Controls and standards are applied uniformly across systems, environments, and teams to reduce variance and prevent gaps.
4. **Continuous improvement**  
   We iterate on controls over time – improving effectiveness and auditability while reducing friction for customers and internal teams.

**Compliance and independent assurance (optional section)**

EMPEQ supports customer due diligence with appropriate security documentation and third-party attestations where applicable.

_EMPEQ maintains a NIST 800-171 attestation and is actively progressing toward SOC 2 Type II and CMMC 2.0. Reports are available upon request. Requests can be submitted to security@empeq.co._

**Data protection**

We safeguard customer data through strong encryption practices, secure key management, and tightly controlled access.

**Data at rest**

Customer data is encrypted at rest using modern encryption standards. Where appropriate, sensitive values may be protected with additional controls (e.g., field-level encryption or tokenization) to reduce exposure even in the event of unauthorized access.

**Data in transit**

Data transmitted over networks is protected using industry-standard transport encryption (TLS 1.2+). We use secure configuration practices to reduce downgrade and interception risk.

**Key and secret management**

Encryption keys and application secrets are stored and managed using purpose-built tooling with strict access controls, logging, and rotation practices. Access to sensitive secrets is limited to approved systems and personnel with a verified need.

**Data retention and deletion**

We support clear retention practices and secure deletion workflows aligned to operational needs and customer requirements.

**Product security**

EMPEQ builds security into the product lifecycle – from design to deployment.

**Secure development lifecycle**

We incorporate security review into planning and implementation, including secure coding practices, peer review, and automated checks in the development pipeline.

**Vulnerability management**

We identify and remediate vulnerabilities through a combination of automated scanning and structured remediation workflows, prioritizing issues based on severity and exposure.

Typical coverage includes:

- Application and dependency scanning (SCA)
- Code analysis (SAST)
- Runtime and endpoint monitoring where applicable
- Periodic external validation (as appropriate)

**Incident response**

We maintain an incident response process that includes triage, containment, eradication, recovery, and post-incident review – plus customer communications procedures when notice is required.

**Enterprise security**

We protect EMPEQ’s internal environment with controls designed for modern, distributed teams.

**Endpoint protection and device management**

Corporate devices are centrally managed to enforce baseline security controls such as disk encryption, strong authentication, screen lock policies, and timely patching.

**Identity and access management**

Access to internal tools is governed by role-based access controls, strong authentication, and timely provisioning/deprovisioning. Access is reviewed periodically and removed promptly when no longer required.

**Vendor and third-party risk**

We evaluate vendors using a risk-based approach – considering data access, production integration, and business criticality – then apply due diligence and contractual safeguards proportionate to that risk.

**Security training and awareness**

We provide security awareness onboarding and periodic training so employees understand threats, responsibilities, and how to report concerns.

**Privacy**

EMPEQ designs privacy into how we collect, process, and store information.

- We minimize collection to what’s necessary for legitimate business purposes.
- We apply access controls and logging to protect personal and sensitive data.
- We maintain clear internal procedures for privacy requests and customer support.
- We aim to align with common privacy obligations relevant to our customers and markets.

**[Privacy policy](https://empeq.co/privacy-policy/)**  
• **[Security contact](mailto: security@empeq.co)**  
• [**Report a vulnerability**](mailto: security@empeq.co)

**Contact our security team**

Questions about EMPEQ’s security posture, due diligence, or vendor onboarding?

**Contact:** [security@empeq.co](mailto:security@empeq.co)