Legal
Epicz Lab AB | Version 1.0 | Effective date: This document applies from the Effective Date specified in the applicable Order Form, unless otherwise expressly agreed in writing.
These Security Measures describe the administrative, technical and physical safeguards for Customer Information processed through the Epicz Lab Services. They support the security commitment in Section 4.2 of the Master Subscription Agreement (MSA).
Epicz Lab will implement and maintain appropriate administrative, physical and technical safeguards during the Service Period to protect the security, confidentiality and integrity of Customer Information, as required by the MSA. Capitalized terms not defined here have the meanings given in the MSA.
These Security Measures address the Services and Epicz Lab personnel and systems involved in their delivery. Customer-managed systems and third-party products remain subject to the responsibilities and terms applicable to those systems and products. Where a data processing agreement (DPA) applies, it governs the processing of personal data together with its applicable security annex.
These Security Measures do not transfer ownership of Customer Information or expand Epicz Lab's rights to use it. Those rights remain governed by the applicable agreement.
Epicz Lab's internal Information Security Policy applies to employees, contractors, consultants and other personnel handling company or customer information. Personnel are required to read, understand and comply with the policies relevant to their roles. The policy requires review at least annually and provides for compliance monitoring, audits and management of exceptions through the Security Delegate.
Internal policies address access control, asset management, cryptography, data management, incident response, secure development, operations security, physical security, risk management, business continuity and supplier management. These internal policies guide personnel; references to them in this document do not independently incorporate every internal procedure into the customer agreement.
Confidential Information is handled in accordance with Section 4.1 of the MSA, including restrictions on its use and disclosure and access by personnel who need it for the purposes of the agreement.
Epicz Lab's personnel policy restricts access, use and sharing of proprietary information to what is authorized and necessary for assigned duties. It prohibits sharing account passwords or giving another person access through an unsecured device. Passwords must comply with the internal Access Control Policy.
Company-provided remote access software must be configured for multifactor authentication. Personnel devices must be locked when unattended and use a password or equivalent screen lock after 15 minutes of inactivity. Remote-working computers must use antivirus protection with automatic updates and a current software firewall. Personnel may not disable organizational security controls on company-issued computers.
The policy requires departing personnel to return company-owned devices and delete company information and accounts from personal devices. These personnel requirements are separate from authentication features available to Customer users of the Services.
Epicz Lab uses cloud infrastructure in Europe as the primary hosting location for Customer Information. Additional processing locations and international transfers are governed by the applicable agreement and DPA.
Epicz Lab's Operations Security Policy requires production systems and networks to follow documented configuration and hardening standards. These include changing default passwords, removing or disabling unnecessary accounts and functionality, and restricting inbound network traffic to authorized services and ports. Production network access rules must be reviewed at least annually, and changes are subject to approval and change management procedures.
Development and staging environments, when used, must be segregated from production. Confidential production Customer Information must not be used for development or testing without express management approval and must be scrubbed of sensitive information wherever feasible.
This restriction does not apply to temporary preview environments used for testing and validation. These may contain a full copy of production data, provided they are accessible only to authorized personnel, secured to the same standard as production, and automatically deleted together with all data within three (3) days of creation.
Any such use remains subject to the Customer's permitted purposes and instructions under the applicable agreement.
Processing capacity and storage must be monitored and adjusted to meet documented operational standards and contractual requirements. Remote access for vendors and business partners must be enabled only when needed for business purposes and deactivated after use.
Epicz Lab's Operations Security Policy requires production systems to generate relevant operational and security logs, protect them against tampering and unauthorized access, and configure alerts for events presenting significant security risks.
Epicz Lab maintains a Cryptography Policy covering company-developed or controlled information systems that store or transmit confidential information. The policy requires strong cryptographic ciphers and configurations for Customer Information when stored or transmitted over public networks, in accordance with vendor recommendations and industry best practices.
Where encryption is used, associated key management processes and procedures must be implemented and documented. Access to cryptographic keys and secrets is controlled in accordance with Epicz Lab's Access Control Policy. Industry standards, including NIST SP 800-57, guide implementation where feasible.
The policy recommends AES-256 for confidential data at rest and secure one-way hashing for stored passwords, where appropriate and feasible. Any exceptional use of removable media for confidential information requires documented approval, and portable devices or removable media containing sensitive information must use approved encryption.
Epicz Lab maintains a Secure Development Policy covering business-critical applications and systems that process, store or transmit confidential information. The policy applies to internal and external developers and requires security to be incorporated throughout the development lifecycle.
Significant code changes must be reviewed and approved before being merged into a production branch. Formal change controls require approval and oversight where development, testing and deployment are performed by a single individual. Software is version-controlled, with access to central repositories restricted according to personnel roles.
Secure engineering practices include secure defaults, least privilege, defence in depth and privacy by design, applied where feasible. Development environments must be appropriately protected, with production and development environments logically or physically separated where feasible and appropriate.
Security functionality must be tested at defined intervals during development. Business-critical applications must also be reviewed and tested following changes to operating platforms or cloud services to assess potential operational and security impacts. Outsourced development is subject to Epicz Lab's supervision and applicable development standards.
Epicz Lab maintains a Business Continuity and Disaster Recovery Plan covering business-critical information systems. The plan assigns responsibilities for assessing disruptions, coordinating recovery with hosting providers, restoring services and communicating with affected customers.
Epicz Lab's Operations Security Policy requires regular backups of relevant systems and data, stored separately from the production data location and encrypted at rest and in transit. Backup and recovery procedures must support applicable service levels and contractual obligations.
The continuity plan requires disaster recovery testing, including testing of backup restoration processes, at least annually. Recovery procedures include assessment of the disruption, restoration or relocation of affected services, and testing of system availability and security controls. Any relocation remains subject to agreed data-location restrictions and applicable data protection requirements.
Customer Support, together with executive management, coordinates customer communications concerning relevant disruptions and recovery actions. Contractual availability commitments and remedies remain governed by the applicable SLA. Internal recovery objectives do not create additional contractual guarantees unless expressly agreed in writing.
Epicz Lab's personnel policy requires known or suspected security events, incidents, policy violations and observed weaknesses to be reported immediately or as soon as possible to the Security Delegate. The policy framework includes an Incident Response Plan for suspected or confirmed information security incidents.
Customers should promptly report suspected unauthorized access or use affecting the Services to support@epiczlab.com. The report should identify the affected environment, the time of observation, the suspected impact and a contact for follow-up. Customers should not include passwords, tokens or unnecessary sensitive information.
Customer notifications, cooperation and other obligations relating to an incident are governed by the applicable agreement, DPA and applicable law. Internal incident reporting requirements do not establish a separate fixed customer-notification deadline.
Epicz Lab's policy framework includes a Third-Party Management Policy addressing information and assets shared with, accessible to or managed by suppliers. The applicable DPA governs any agreed requirements for subprocessors handling personal data.
Epicz Lab's internal policies require personnel to protect company and customer information and use approved business storage. They prohibit use of removable media to export or store company or customer data. Personnel must keep confidential materials secure and promptly report loss, theft or unauthorized disclosure.
Under Section 4.1 of the MSA, use of Confidential Information must cease promptly upon termination or when it is no longer needed for the purposes of the agreement. This obligation to cease use is distinct from the technical retention and deletion arrangements for production systems and backups.
Customers are responsible under the MSA for authorized use of credentials, compliance with the agreement, accuracy of input data and prompt notification of unauthorized access or use. Authorized Users must not share accounts or passwords.
Customers should protect their devices and integration credentials, configure available security features appropriately, and provide only information that they are authorized to process through the Services. They should coordinate with Epicz Lab when troubleshooting requires diagnostic data or access to Customer-managed systems.
Security measures do not establish the accuracy or suitability of AI Outputs. As stated in Section 1.4 of the MSA, Customers remain responsible for reviewing and evaluating AI Outputs before material reliance or implementation.
These Security Measures must be read together with the applicable MSA, Order Form, DPA and SLA. They do not amend the agreement's provisions on liability, permitted use of information, service availability or remedies. Any conflict is resolved under the applicable contractual terms.
The approved version should identify its effective date and version number. Changes to contractual security commitments remain subject to the applicable agreement and cannot be made effective merely by changing the publication date of this document.
For security questions or to report a suspected issue affecting the Services, contact Epicz Lab support. Sensitive diagnostic information should be shared only through a suitable method agreed with support.
Log in