1. Overview
At Epsi Prime, customer trust is our foundation. Protecting your data is our highest priority, and security is deeply embedded in the way we design, build, and operate our services. This Security Policy outlines the technical, organizational, and procedural safeguards we implement to ensure the confidentiality, integrity, and availability of customer data. We are committed to building and maintaining a secure, reliable CRM system that meets international security standards and complies with data privacy laws.
2. Security & Data Encryption
All customer data is encrypted both in transit and at rest:
In Transit: All data exchanged between users and servers is encrypted using SSL/TLS 1.3 to prevent eavesdropping or man-in-the-middle (MITM) attacks.
At Rest: Data stored in our infrastructure is protected with AES-256, a banking-grade encryption standard
End-to-End Encryption (E2EE): Sensitive communications are end-to-end encrypted, ensuring that only the sender and recipient can decrypt them.
Backups and disaster recovery copies are encrypted to the same standards. Encryption keys are managed through secure Hardware Security Modules (HSMs) with strict key rotation policies.
3. Authentication & Access Control
We enforce strict authentication measures to prevent unauthorized access.
Multi-Factor Authentication (2FA/MFA) is supported for all users and required for administrative accounts, Passwords must comply with a strong password policy and are automatically rotated or expired within defined time frames.
Access to systems follows the principle of least privilege, and Role-Based Access Control (RBAC): Granular role-based authorization (Administrator, Manager, User, Guest) to precisely control the scope of access, ensures employees can only access the data necessary for their role.
Single Sign-On (SSO): Integrate SSO with identity providers such as Google, Microsoft, Okta for enhanced security and benefits.
Session Management: Expired login sessions, auto-login when inactive.
4. Infrastructure Security
Epsi Prime services are hosted on trusted cloud providers certified under ISO/IEC 27001, SOC 2 Type II, and PCI DSS. Our infrastructure is protected by multi-layer firewalls, intrusion detection and prevention systems (IDS/IPS), and Protected against Distributed Denial of Service attacks (DDoS).
Systems are continuously monitored 24/7 for suspicious behavior, with critical alerts escalated immediately to our on-call security team. Disaster recovery and business continuity strategies are regularly tested to guarantee resilience and uptime. Have DRP (Disaster Recovery Plan) and BCP (Business Continuity Plan) to ensure resilience in emergency situations.
5. Application Security
Security is integrated into our software development lifecycle (SDLC). All code undergoes automated vulnerability scanning, peer reviews, and static analysis. External penetration testing is conducted regularly by accredited third parties.
Our engineering practices comply with OWASP Top 10 guidelines, and critical vulnerabilities are remediated with the highest priority, regularly check and prevent common blocks (SQL Insert, XSS, CSRF, IDOR…). Security patches and system updates are proactively deployed across our environments. Perform any penetration testing (pentest) determined by an independent third party (Penetration Testing), encourage the security community to report security vulnerabilities through a bounty program (Bug Bounty Program).
6. Compliance & Privacy
Epsi Prime complies with international regulations and standards:
GDPR (General Data Protection Regulation – EU)
CCPA/CPRA (California Consumer Privacy Act – US)
ISO/IEC 27001 (Information Security Management System)
SOC 2 Type II (Service System Administration and Control)
PCI DSS (Payment Card Industry Data Security Standard – if processing payments)
HIPAA (Health Insurance Portability and Accountability Act – if CRM handles medical data)
eIDAS, ESIGN, and UETA for electronic signature services through EpsiSign.
7. Monitoring & Incident Response
Epsi Prime maintains centralized logging, monitoring, and Security Information and Event Management (SIEM) systems that aggregate activity across all infrastructure and applications. Anomalous activity triggers real-time alerts.
In the event of a confirmed security incident, our incident response team will have a cybersecurity incident response process, including detection, containment, remediation and notification to customers (as required by GDPR & international laws). In compliance with GDPR, customers will be informed within 72 hours of a data breach that affects their information. Transparent post-incident root cause analyses are shared when relevant. Record full access logs and data changes to serve incident analysis (Audit Logs);
8. Your Role in Security
While Epsi Prime maintains robust security standards, protecting your account and data is a shared responsibility. As a customer, you are expected to:
Safeguard your credentials – Never share passwords or API keys. Use strong, unique passwords and enable MFA wherever available.
Manage user access – Regularly review and update roles and permissions within your organization to ensure only authorized personnel have access.
Keep systems updated – Ensure devices and browsers used to access our Services are patched and secured.
Report suspicious activity – Notify us immediately at security@epsilabs.com if you suspect unauthorized access or unusual behavior.
Comply with laws and policies – Ensure that your use of the Services and your handling of Customer Data comply with applicable privacy, data protection, and security regulations.
Failure to follow these responsibilities may increase risks to your data and your organization.
9. Security Awareness & Training
Employees are periodically trained on information security, phishing detection, and data security.
Perform background checks on all personnel with access to customer data.
10. Contacting Our Security Team
If you have any concerns or discover a potential vulnerability, please contact our dedicated security team at security@epsilabs.com
For urgent issues, please include the subject line [SECURITY ALERT] so we can prioritize your request.
11. Our Commitment
At Epsi Prime, safeguarding customer data is not optional—it is our commitment. We will continue to invest in advanced security technologies, industry best practices, and proactive monitoring to ensure that our customers can trust us with their most valuable information.