How we protect your data and working environment
Protection is built in layers. The exact controls depend on the selected service and architecture, and are confirmed in the specification and agreement before deployment.
Identity and access
Roles, groups, least privilege, and where included, MFA and SSO help limit who can access accounts, files and operations.
Network and transmission
Managed WireGuard and site-to-site VPN can protect traffic between people, offices and ELM services. Where appropriate, separate VRF routing and firewall rules isolate customer networks.
Applications and files
Depending on the deployment, controls may include TLS, version history, ETag change protection, file type checks, scanning and blocking active content. Read, edit, share and send permissions can be separated.
Monitoring and recovery
We agree monitoring, backups, retention, restore tests and recovery targets for the chosen service. High availability requires suitable redundancy and tested failover.
AI with human oversight
The office assistant works with approved sources and tools within assigned permissions. Sending, publishing, sharing or changing data can require human approval.
Clear boundaries
VPN protects traffic in transit but does not automatically secure an endpoint or an open document. VRF separates routing but does not encrypt packets. Server location alone does not establish legal compliance.
Information only. The final protection level depends on the ordered scope, configuration, integrations, customer procedures and contractual terms.