At Emojot, security, privacy, and compliance are foundational to how we design, build, and operate our platform. We understand that our customers trust us with their data, and we are committed to protecting it through a comprehensive, risk-based security program aligned with international standards and industry best practices.

Compliance & Certifications

Emojot maintains a robust compliance program aligned with globally recognized standards:

• ISO/IEC 27001:2022 Certified – Our Information Security Management System (ISMS) is independently audited and certified to ensure effective security governance and risk management.
• SOC 2 Type II Attested – Our controls are independently audited for operational effectiveness across security and availability.
• GDPR-Aligned – Our platform and processes are designed to support customers in meeting EU General Data Protection Regulation (GDPR) requirements.
• HIPAA-Aligned – Emojot implements administrative, physical, and technical safeguards designed to support HIPAA requirements.
• CCPA-Aligned – We support customer compliance with the California Consumer Privacy Act (CCPA).

 

Additional compliance documentation, including audit reports, may be made available under NDA upon request.

Infrastructure Security

Emojot’s platform is hosted on Amazon Web Services (AWS), leveraging a highly resilient and secure cloud infrastructure.

Our infrastructure security controls include:

• Web Application Firewalls (WAF)
• Intrusion Detection Systems (IDS)
• Continuous infrastructure monitoring
• Real-time access trail monitoring and alerting
• Automated vulnerability scanning and patch management
• Segregated development, testing, and production environments
• Encrypted and regularly tested backups
• Formal Business Continuity and Disaster Recovery planning (BCDR)

 

Access to production systems is strictly controlled through:

• Secure connectivity (VPN/SSH)
• Multi-factor authentication (MFA)
• Least-privilege access controls
• Quarterly access reviews
• Immediate revocation upon employee termination

Application Security

Security is integrated throughout our secure software development lifecycle (SDLC). We employ a DevSecOps approach to proactively identify and remediate vulnerabilities before release.

Our practices include:

• Secure coding aligned with OWASP Top Ten
• Peer code reviews prior to production deployment
• Static Application Security Testing (SAST) integrated into the CI/CD pipeline
• Software Composition Analysis (SCA) to monitor and manage open-source dependencies
• Risk-based vulnerability remediation and tracking
• Strict segregation of development, testing, and production environments
• Tenant isolation within a secure multi-tenant architecture
• API authentication and authorization using OAuth2

Data Protection & Encryption

Emojot implements strong cryptographic controls to protect customer data:

• Encryption at rest using AES-256
• Encryption in transit using TLS 1.2/1.3
• Encrypted backups
• PII masked by default within the application

 

Emojot acts as a data processor, while customers retain full ownership and control of their data as data controllers. We provide tooling to support data subject requests, including modification and deletion.

Identity & Access Management

Emojot applies centralized identity governance across both internal systems and customer-facing environments.

• Cloud-based Identity-as-a-Service (IDaaS) powered by WSO2 Asgardeo
• Support for enterprise Single Sign-On (SSO) integrations
• Standards-based authentication using OIDC and OAuth 2.0
• Role-Based Access Control (RBAC)
• Principle of Least Privilege access model
• Periodic access reviews and permission governance
• Secure provisioning and timely de-provisioning processes

 

Enterprise customers may integrate Emojot with their own Identity Provider (IdP) to enforce their organizational authentication policies, including additional security controls such as Multi-Factor Authentication (MFA), where applicable.

Customer administrators retain full control over user roles and permissions within their respective tenant environments.

Vulnerability Management & Testing

We maintain a proactive vulnerability management program:

• Regular automated vulnerability scanning
• Timely patch management based on severity
• Independent third-party penetration testing
• Internal and external security assessments
• Formal remediation processes aligned with risk severity

 

Executive summaries of penetration testing and audit assessments may be provided upon request.

Security Monitoring & Logging

Application and infrastructure systems generate centralized logs used for:

• Security monitoring
• Incident investigation
• Audit support
• Operational troubleshooting

 

Logs are securely stored and retained in accordance with regulatory and business requirements.

Incident Response & Breach Notification

Emojot maintains a formal incident response program that includes:

• Defined response procedures
• Investigation and remediation workflows
• Annual testing of incident response processes
• Customer communication protocols

 

In the event of a confirmed security breach impacting customer data, Emojot will notify affected customers within 72 hours of identification, in accordance with applicable regulatory requirements.

Business Continuity & Disaster Recovery

Emojot maintains a formal Business Continuity and Disaster Recovery Plan (BCDRP) designed to ensure service resilience.

• Full and incremental backups performed on a rotating schedule
• Backup encryption and integrity verification
• Regular restoration testing
• Periodic BCDRP testing and updates

Risk Management & Governance

Emojot operates a formal risk management program designed to:

• Identify information assets and associated threats
• Assess risk likelihood and impact
• Implement appropriate security controls
• Monitor and review risks continuously

 

Security risks are reviewed regularly by the Emojot Security Team as part of ongoing governance processes.

Personnel Security & Training

We recognize that security begins with people.

• Background checks conducted where legally permitted
• Mandatory confidentiality agreements
• Annual security awareness training
• Role-specific training (GDPR, HIPAA, secure coding, privacy law)

 

Security training and compliance are overseen by our dedicated Security Team.

Responsible Disclosure

We welcome responsible disclosure of potential vulnerabilities.

If you believe you have identified a security issue, please contact us at: security@emojot.com

We are committed to investigating and addressing reported issues promptly.

Our Commitment

Security is not a one-time effort — it is an ongoing commitment. Emojot continuously evaluates and enhances its security posture to meet evolving threats, regulatory requirements, and customer expectations.

For additional security information or documentation requests, please contact our Security Team: security@emojot.com