Legal
Security Information
An overview of Empire's approach to account protection, infrastructure security, access controls, data handling, and customer responsibility.
1. Scope of this page
This page describes, factually, how Empire protects workspace data and what we deliberately do not claim.
2. Access control
Workspace records are protected at the database level so that they can be read and written only by the account holders entitled to them.
Internal administrative data, such as sales enquiries, is accessible only to authenticated staff holding an explicit staff role. Roles are stored separately from user profiles and checked server-side.
Workspace owners can review who has access, manage permissions, and remove access when it is no longer required.
3. Authentication
Authentication is handled by a managed authentication provider. Passwords are not stored by Empire in plain text and are never visible to us.
Sessions can be ended by signing out, and access is revoked when an account is removed from a workspace.
4. Data in transit and at rest
Traffic between your browser and Empire is transmitted over encrypted connections.
Data is stored in managed database and object storage services operated by our infrastructure provider, with encryption at rest provided by that platform.
5. Activity visibility
Important workspace actions and changes are recorded so account holders can review what happened and when.
6. Exports
Customers can prepare and export organised business records from their workspace, so your records are not locked into Empire.
7. Reporting a vulnerability
Suspected vulnerabilities can be reported to support@empirekeep.com with the subject line “Security report”.
Please include enough detail to reproduce the issue and allow us a reasonable period to respond before public disclosure. We do not currently publish a response-time commitment.
8. What Empire does not claim
Empire does not claim SOC 2, ISO 27001, PCI DSS, or any other certification.
Empire does not claim deposit insurance, government approval, banking licences, or “bank-grade” security.
Empire does not guarantee compliance with any regulatory framework, and no system can be guaranteed completely secure.