Security & Hosting

Your compliance records are your legal evidence. We build and run globalEPR.ai to enterprise standards — from the infrastructure underneath it to every single login.

Google Cloud-backed infrastructure

Cloud infrastructure

globalEPR.ai runs on Google Cloud infrastructure (through our managed hosting provider), benefiting from Google's global network, physical data-centre security, and industry-leading compliance certifications including ISO 27001, SOC 2 and SOC 3.

TLS everywhere

All traffic between your browser and the platform is encrypted with TLS. Data is also encrypted at rest — the default standard on Google Cloud's storage layer.

Isolated production environment

Production is fully separated from development. Uploaded files, backups and logs live outside the web root and are never directly publicly accessible.

Data protection & business continuity

Automated daily backups

The platform is backed up daily, with copies stored off-machine in separate cloud object storage — fully recoverable even after a total host failure.

10-year record retention

Every plan retains your DoCs and compliance records for the full 10-year period while you are subscribed, aligned with the EU PPWR's document-keeping requirements.

GDPR compliance

We process personal data under the GDPR: a Data Processing Agreement (DPA), EU Standard Contractual Clauses (SCCs), deletion-request workflows and data portability are all in place. See our Privacy Policy and DPA.

Application & account security

Two-factor authentication (2FA)

TOTP-standard two-factor authentication is supported and mandatory for administrator accounts. Secrets are encrypted at rest.

Modern cryptography

Passwords are stored with Argon2id — one of the strongest password-hashing algorithms in current use. Passwords are never stored in plain text and never set by administrators.

Defence in depth

Login rate-limiting, account lockout, session timeouts, global CSRF protection, parameterised SQL throughout, an upload file-type allowlist, and re-authentication for dangerous actions.

Complete audit trail

Every login, change and signature leaves a tamper-evident audit record — a security measure that doubles as your chain of proof under regulatory scrutiny.

We're happy to answer questions about our infrastructure, data handling or compliance certifications — including security questionnaires for enterprise procurement.