Security
Designed with enterprise security principles
EOL.ai holds inventory data that describes an organisation's attack surface. It is treated accordingly.
Tenant isolation
Every asset row belongs to exactly one organisation. Access is enforced in the database with row-level security, not only in the application, so a user from one company cannot read another company's inventory.
Authentication
Email and password sign-in with Google sign-in supported. Sessions are managed by the platform's authentication service; passwords are never stored by the application.
Role-based access
Organisation membership carries a role — owner, admin, IT manager, analyst, executive, read only or member — which governs what a user can see and change.
Evidence and auditability
Lifecycle records store their source, evidence status and last verification date, so any figure shown in a report can be traced back.
What we do not claim
EOL.ai holds no SOC 2, ISO 27001, HIPAA or FedRAMP attestation, and makes no compliance claims. Encryption in transit and at rest, backups and data retention are provided by the underlying managed cloud platform.
Security roadmap
- SOC 2 readiness programme
- SSO (SAML) and SCIM provisioning
- Organisation-level audit log with export
- Configurable data retention and deletion
Security questions or vulnerability reports: contact the team through your account owner. A published disclosure policy is planned.