Security

EMEGA applies layered administrative, application, and infrastructure controls proportionate to the configured service and risk. Security is a shared responsibility between the platform operator, hosting provider, customer organization, administrators, users, and connected providers.

The platform supports authenticated access, role and permission checks, organization separation, branch and team scope, session protection, and audit records. Customers must assign least privilege, use unique accounts, protect login devices, and remove access promptly when duties change.

Provider tokens and application secrets must be stored in protected configuration or encrypted credential storage, masked in the interface, and excluded from logs and source control. OAuth state, callback mapping, webhook verification, and provider signatures should be validated where supported.

Controls include request validation, CSRF protection, output escaping, private file handling, permission-aware routes, upload restrictions, rate and abuse controls, audit logging, and separation of internal notes from customer-visible messages. Actual deployment controls depend on the enabled modules and hosting configuration.

The operator must use supported software, HTTPS, secure database access, restricted file permissions, monitored queues and scheduled jobs, backup rotation, restoration tests, and production logging without exposed secrets. Backups must be protected to a level appropriate to the source data.

Authorized users must check recipients before sending files, avoid public links for protected records, secure downloaded exports, and remove local copies when no longer needed. Customer-managed computers, email accounts, browsers, networks, and connected systems remain the customer’s responsibility.

Suspected unauthorized access, token exposure, malware, data loss, or incorrect disclosure should be reported immediately. The operator should contain the issue, preserve relevant evidence, assess affected data and people, coordinate with the customer and providers, restore service safely, and make required notifications within applicable deadlines.

Report a suspected vulnerability privately through the Contact and Support page with reproduction details and impact. Do not access other people’s data, disrupt production, publish an unremediated issue, or use automated testing without written authorization.

No system can be guaranteed completely secure. EMEGA’s controls reduce risk but do not eliminate it. Customers should conduct their own risk, legal, and configuration review before placing sensitive or critical workflows into production.