Policy
Data Protection & Security Overview
Last updated 16 October 2026
Draft - subject to legal review before publication. Bracketed text marks information that must be confirmed. This draft is not legal advice.
This overview describes our current security practices for this website and the principles that will govern the Epinova platform. Epinova does not currently claim any security certification.
This website
- HTTPS-only with HSTS, and a restrictive Content Security Policy.
- Form submissions validated server-side, protected by CSRF tokens, rate limiting and spam controls.
- Email delivered via authenticated SMTP; credentials are stored server-side outside the public web directory.
- Uploaded files are restricted by type and size, are not stored on our web server, and are sent only to our internal team mailbox.
- No third-party trackers are loaded without consent.
Platform principles (in development)
- Role-based, least-privilege access and audit logging.
- Encryption in transit and at rest.
- Data residency options discussed with each partner.
- Formal data-sharing agreements before any data is processed.
- Secure development practices, dependency monitoring and independent security testing before production use.
Reporting a vulnerability
If you believe you have found a security issue on this website, please tell us through the contact form and we will respond promptly. [A dedicated security contact will be published at /.well-known/security.txt.]