Access surfaces
Public site, customer portal and owner/admin are separate trust surfaces.
Verified boundary
SECURITY ASSURANCE
Security should be verifiable.
EPTT has a verified baseline for sessions, CSRF, customer isolation, release control and the public security edge. MFA, recovery, encryption at rest, log retention, backup and incident processes remain open gates until documented.
Identity & session
Server-side sessions, CSRF protection, secure cookie controls, expiry and revocation are implemented.
Verified
Authorization & customer boundaries
Customer records and downloads follow explicit customer-party grants and release grants.
Verified
Release & change control
Deployed release, artifact hash, live checks and rollback path are tracked in the controlled release chain.
Verified
SECURITY VERIFICATION
Documented security. Clear open items.
EPTT has a verified baseline for sessions, CSRF, customer isolation, release control and the public security edge. MFA, recovery, encryption at rest, log retention, backup and incident processes remain open gates until documented.
01
Authentication & MFAPassword/session login is active. MFA/2FA, account recovery and step-up authentication are not yet verified.
Partially documented
02
Session lifecycle30-day expiry, logout, blocked-user invalidation and central session revocation are implemented.
Verified
03
Authorization modelOwner/admin and customer surfaces are separated; customer access follows explicit grants.
Verified
04
Encryption & secretsTLS and the public edge are verified. At-rest encryption and key-rotation policy remain open.
Needs verification
05
Audit & retentionLogin and release actions create audit records. Retention and deletion policy remain open.
Partially documented
06
Vulnerability & updatessecurity.txt and the security-contact flow are live. Triage and patch cadence remain open.
Partially documented
07
Backup securityBackup encryption, restore access and restore-test cadence remain open for the final model.
Needs verification
Have a concrete security requirement?
Use the technical dialogue for requirements around access, network boundaries, logging, deployment or documentation.