Security built for public-sector review.
We run career profiles for more than 120 ministries and statutory bodies, in markets where national regulators set the bar for data protection. Every customer gets the same controls.
Government information security offices and enterprise procurement teams in the markets we operate in have reviewed and approved our security programme.
Compliance status.
CSA STAR Level 1
Cloud Security Alliance STAR self-assessment, completed and published.
ISO/IEC 27001
We operate our controls to ISO 27001; formal certification is on the assurance roadmap.
SOC 2 Type II
Controls are mapped to the Trust Services Criteria; the Type II audit is on the roadmap.
GDPR, UK GDPR and PDPA
Epitome acts as data processor. A data processing agreement (DPA), EU standard contractual clauses and the UK addendum are available.
Documents for your review
Request the security overview, data processing agreement and responsible AI documentation from the trust centre.
Six control areas your procurement and audit teams can check line by line.
Encryption and keys
AES-256 at rest and TLS 1.2 or 1.3 in transit. Keys are managed in AWS KMS with rotation, and backups are encrypted.
Regional hosting
Deployment in Singapore, Ireland or Virginia. Enterprise clients can have a dedicated database instance.
Identity and access
Role-based access with least-privilege defaults, multi-factor authentication for every administrative account, and single sign-on for enterprise customers.
Testing
An annual third-party penetration test, static and dynamic scanning plus dependency checks in the build pipeline, and a web application firewall with DDoS protection.
Incident response
Documented response with severity-based triage. Recovery point objective of 12 hours or less, recovery time objective of 24 hours or less. Clients are notified without undue delay, with a 72-hour target.
Audit logging
Immutable logs of administrative actions, monitored centrally and retained to match regulatory and contractual requirements.
Four rules we apply to every product decision.
Collect only what a feature needs
We collect only the data each feature uses, and controllers can see exactly which data that is.
Consent for each purpose
Every processing purpose has its own consent. People can withdraw consent or correct their data themselves or through the Data Protection Officer.
Need-to-know access
Role-based access across the platform. Internal access is logged and reviewed.
Data subject rights
Access, correction, erasure, portability, restriction and objection, each with a documented process.
Give your security team what they need before the review.
From the trust centre you can request the security overview and responsible AI documentation, read the privacy documents and see current compliance status.