# EQIQs™ Enterprise Security

Last reviewed: 2026-10-17 · Owner: Jessica Michelle Baker · Review cadence: 90 days

## Certifications & Compliance
- SOC 2: not certified. Type I audit considered when an Organization or Enterprise prospect requests it; no audit dates committed. Provider certifications do not certify EQIQs.
- GDPR-aligned (EU/UK data subjects)
- CCPA / CPRA aligned (California residents)
- HIPAA: no compliance claim; a BAA is not a standard plan feature. Discuss requirements before submitting protected health information.
- ISO 27001: roadmap

## Infrastructure
- Hosted on managed cloud infrastructure
- All data encrypted in transit (TLS 1.3) and at rest (AES-256)
- Daily encrypted backups, point-in-time recovery (7 days)
- US-East primary region; EU region available on Enterprise tier

## Authentication
- Email/password with bcrypt + PKCE
- Google OAuth (BYOC)
- SAML 2.0 SSO (Okta, Azure AD, JumpCloud, Google Workspace, OneLogin)
- Magic-link OTP fallback
- Session timeout configurable per workspace

## Access Control
- Role-based: Individual, Professional, Organization Admin, Enterprise Admin
- Row-Level Security (RLS) enforced on every table
- Per-workspace data isolation
- Audit log for all admin actions (Enterprise tier), retained 365 days

## Subprocessors
- Supabase, Inc. (database, auth, storage, edge functions)
- Stripe, Inc. (payments, subscriptions, Stripe Connect payouts)
- Resend / Drie B.V. (transactional + marketing email — updates.eqiqs.com)
- Lovable AI Gateway (Google Gemini, OpenAI)
- Google LLC — Google Analytics 4 (consent-gated)
- Meta Platforms, Inc. — Meta Pixel (consent-gated)
- PostHog, Inc. (product analytics + session replay, consent-gated)
- Crazy Egg, Inc. (heatmaps, consent-gated)
- Sentry / Functional Software, Inc. (error monitoring)
- Lovable.dev / Lovable AS (application hosting)

Full list with data categories: https://www.eqiqs.com/subprocessors

## Email Authentication
- SPF, DKIM, DMARC configured on sending domains
- DMARC reports: rua=mailto:jessica@eqiqs.com
- Strict alignment (adkim=s, aspf=s)

## Data Retention
- Active accounts: data retained while subscription is active
- Cancelled accounts: 90-day grace period, then automated deletion
- Shared report tokens: auto-expire and purge after 60 days
- Comparison invites: purged after 90 days
- Admin audit log: 365 days
- Stripe event log: 90 days
- One-click export (CSV/JSON) available in Settings → Data & Privacy

## Vulnerability Management
- Continuous dependency scanning (Snyk + npm audit)
- Quarterly third-party penetration testing
- Bug bounty: security@eqiqs.com
- Responsible disclosure window: 90 days

## Backup & Disaster Recovery
- Daily encrypted backups with 7-day point-in-time recovery
- Quarterly restore drill (documented procedure)
- RTO target: 4 hours; RPO target: 1 hour

## Data Processing Addendum
- Standing DPA published (no request needed): https://www.eqiqs.com/legal/dpa
- Includes SCC Annex I (transfer details) and Annex II (technical measures)
- Counter-signed PDF on request: BD@EQIQs.com

## Contact
- Security disclosures: security@eqiqs.com
- DPO / Privacy: privacy@eqiqs.com
- Enterprise procurement: BD@EQIQs.com