Security
Your business records should remain understandable, controlled, and accessible.
Security on this page means something specific: who can reach your workspace, what happens to the records inside it, and what you can take with you. Everything below describes controls that exist today. Nothing describes an audit, certification, or guarantee that Empire has not obtained.
The controls that matter most
Workspace controls
Workspace owners can review who has access, manage permissions, and remove access when it is no longer required.
Activity history
Important workspace actions and changes are recorded and shown so account holders can review what happened and when.
Structured exports
Customers can prepare and export organized business records from their workspace.
Responsible claims
Empire does not claim SOC 2, ISO, or PCI certification, deposit insurance, government approval, bank-grade security, or guaranteed compliance.
How access and data are handled
Plain descriptions of the mechanics behind the workspace, written so they can be understood without a security background.
Accounts and sign-in
Access to a workspace requires an authenticated account. Sign-in is handled through the platform's authentication system, and sessions can be ended by signing out.
Least access by default
People are added to a workspace deliberately. Access is granted per person rather than shared through a single common login, so removal is a single action.
Data in transit
Traffic between your browser and Empire is encrypted using standard HTTPS transport security.
Data at rest
Workspace records are stored in a managed database with access restricted to the workspace they belong to.
Change visibility
Record changes are attributable, so a workspace owner can see what was added or modified rather than discovering a difference later without context.
Your data stays yours
Records created in a workspace belong to the business that created them and can be exported at any time.
Questions people ask
- Is Empire a bank or payment processor?
- No. Empire does not hold funds, move money, or process payments. It organizes records about financial activity that happens elsewhere.
- Do you hold certifications?
- Empire does not currently hold or claim SOC 2, ISO 27001, or PCI certification. Rather than implying an audit that has not happened, this page states the actual controls in place.
- Who can see my workspace?
- Only people the workspace owner has granted access to. Access can be reviewed and revoked by the owner at any time.
- What happens to my records if I leave?
- You can export organized records before closing an account. Exports are structured so they remain usable outside Empire.
Suspected vulnerabilities can be reported to support@empirekeep.com with the subject line “Security report”. No response-time commitment is currently published.