Public trust summary
Security, uptime & subprocessors
Product: emPOWER SaaS ERP (accounts.empowerapp.in). For prospects, customers, and security questionnaires. Last updated 2026-07-28.
Security posture
| Auth | Session cookies + optional MFA (email OTP); mobile Bearer for client API |
|---|---|
| Authz | RBAC permission vocabulary; module entitlements; tenant org scope on reads/writes |
| Tenancy | Organization-scoped data access; isolation tests are release blockers |
| Commercial caps | Seat, company, storage, and NOVA credit hard limits on invite / upload / LLM paths |
| Secrets | Env-based; not in client bundles or public docs |
| Transport | HTTPS on production hosts |
| Backups | Entitlement-gated backup module; restore via Control Centre where entitled |
We do not claim SOC 2 / ISO certification in this one-pager. Ask sales for the current assurance roadmap.
Uptime & operations
- Hosting: Railway production services (SaaS plane)
- Health:
GET /api/health— ok, ready, db, version - Deploy: git-push auto-deploy with version guard after Railway SUCCESS
- Incident: Control Centre tickets + repairs for unlock / invite resend / session revoke
Target for Growth pilots: best-effort continuous operation with same-business-day response on Sev-1 login/billing blockers. Formal SLA numbers are contract-specific.
Core subprocessors
| Subprocessor | Purpose |
|---|---|
| Railway | App hosting, Postgres, object storage |
| Email provider | Transactional mail (signup, invites, MFA OTP) |
| LLM provider(s) | Optional NOVA narration when enabled — RBAC-gated |
| Razorpay | Subscription / invoice collection when billing live |
Delete your account
To request deletion of your emPOWER login and associated personal data, open accounts.empowerapp.in/account/delete. We email a confirmation link and one-time code. Deletion runs only after you confirm with that link, the code, your password, and authenticator MFA if enabled. Organization business records stay with your company. Last Super Admin of a workspace cannot self-delete until another Super Admin exists.
Customer responsibilities
- Keep owner MFA enabled for privileged users
- Assign least-privilege roles; review seats monthly against plan caps
- Do not share Control Centre or SUPER_ADMIN credentials
- Report suspected account compromise immediately
Source markdown: docs/trust/SECURITY_UPTIME_SUBPROCESSORS.md · Security/privacy inquiries via your emPOWER sales or support contact.