Product boundaries
Public surfaces, customer access and owner/admin surfaces should be clearly separated.
Design principle
ASSURANCE LAYER
Trust without vague promises.
EPTT should document product boundaries, responsibility and operating model with the same precision as the product features. Anything not yet verified remains an explicit verification item.
Role & access
Access should be tied to the relevant customer, user and operational context.
Design principle
Deployment responsibility
Cloud, Dedicated and On-Prem should describe who owns which operational tasks.
Design principle
Release integrity
Clients and releases should be tied to version and controlled distribution.
Design principle
ASSURANCE STATUS
Trust Center
EPTT should document product boundaries, responsibility and operating model with the same precision as the product features. Anything not yet verified remains an explicit verification item.
01
Authentication, sessions & MFA/2FALogin method, session lifetime, recovery and step-up authentication must be documented.
Needs verification
02
EncryptionTransport, storage and key handling must be described concretely.
Needs verification
03
Logging & auditEvents, administrative changes and relevant logs need a documented model.
Needs verification
04
Backup & restoreRPO/RTO, restore responsibility and test model must be defined per deployment.
Needs verification
05
DPA, subprocessors & data residencyRoles, suppliers and data location must be documented.
Needs verification
06
SLA & supportService level, incident response and maintenance must be agreed per delivery.
Needs verification
Technical or legal clarification?
Use the contact flow for concrete questions about deployment, responsibility, data and security.
DATA RESPONSIBILITY REGISTER
Data responsibility should be visible before production.
The register shows what must be concretely clarified for the selected deployment. It is not a substitute for legal approval.
DPA / processing terms
When EPTT processes personal data on behalf of a customerRoles, instructions, safeguards and termination handling should be reflected in the agreement.Confirm per agreement
Subprocessors
Where third-party suppliers are used by the selected operating modelThe list, role and change process should be available.Publish before production
Data residency
Cloud / Dedicated / relevant managed servicesHosting and data location should be confirmed for the concrete environment.Confirm per deployment
Retention
Account data, operational data, logs and possible location dataRetention and deletion should be defined by data type and purpose.Define by data type
International transfers
If data or suppliers involve third countriesTransfer basis and relevant safeguards should be documented.Document if applicable