EPAFITrust Center

No badgeswe didn’t earn.

Everything a security review asks for, on one page, with the uncomfortable rows left in. Epafi is pre-launch and holds no certifications — pretending otherwise would be the first thing worth failing us for.

01Posture at a glance

Data residencyEuropean UnionHetzner, in the region set by the deployment configuration

Encryption in transitYesTLS on every request to the application and API

Credential storageHashed & encryptedAPI keys as SHA-256 hashes; export secrets encrypted at the application layer

Tenant isolationEnforced in the data layerOwnership filters plus database tenant-reference constraints

Sub-processorsSix, all namedPublished list with 30-day change notice

Data sold or sharedNeverNo brokers, no ad networks, no model training on your data

Export & exitFree, unlimitedCSV, JSON, vCard — no switching fee, ever

DPAPublic & self-serveArticle 28 terms, already in force with your account

02Certifications & frameworks

What we hold —and what we don’t.

SOC 2 Type IINot heldNo audit has been commissioned. We will not display a badge we have not earned, and we will not describe controls as "SOC 2 aligned" as a substitute.

ISO 27001Not heldSame position. When an audit is underway, this row says so with a date attached.

GDPRAppliesWe are a processor for your contact data and a controller for account data. Roles, bases, transfers, and assistance are documented in full.

HIPAA / BAAOut of scopeEpafi is not designed for protected health information and we do not sign BAAs. Do not import PHI.

EU AI ActNot applicableEpafi exposes no generative AI to users, and no machine-learning model anywhere in the product. Duplicate scoring is algorithmic — fuzzy string distance, phonetic keys, and rules — so the Article 50 transparency duties that applied from 2 August 2026 have nothing to attach to. If that changes, a disclosure page ships before the feature does.

03Documents

Security →

Encryption, access control, infrastructure, SDLC, disclosure

What we process, why, and for how long

GDPR →

Roles, lawful bases, transfers, and controller support

DPA →

Article 28 processor terms, ready to countersign

Sub-processors →

The full list, with change notification

Data portability & exit →

Data Act switching information and the fee position

Accessibility →

EN 301 549 / WCAG 2.1 AA conformance position

Cookie Policy →

Every cookie, and why there is no banner

Reviewing us?

Send your security questionnaire to security@epafi.app. We answer it in writing, we answer the questions we fail, and we do not require a call first.

security@epafi.app Or read the DPA