Trust Center
Security & Privacy at EPM Monitor
Our commitment to your data: what we collect, where it lives, who can access it, and how we keep it safe. Updated continuously — last reviewed .
12/13
GDPR controls
Self-service DSAR
5/5
SOC 2 CCs mapped
Type II planning
TLS 1.3
Encryption in transit
DTLS-SRTP for live view
AES-256
Encryption at rest
Supabase / R2
Architecture & data flow
📦 Where data lives
- • Postgres (Supabase, EU/US regions)
- • Screenshots: customer's own Google Drive OR Cloudflare R2
- • Firebase RTDB (signaling + config push only — never media)
🛜 Live screen view
- • WebRTC peer-to-peer — media never touches our servers
- • DTLS-SRTP encryption end-to-end
- • Session-bound, audited, optional consent prompt
🔑 Authentication
- • bcrypt(12) for passwords
- • Optional TOTP 2FA for admins
- • Session tokens with 12 h TTL, server-side hashed
- • Google / Microsoft SSO supported
Sub-processors
We rely on the following processors. Each has a Data Processing Agreement signed.
| Vendor | Purpose | Region | Certifications |
|---|---|---|---|
| Supabase | Postgres, Auth, Edge Functions | US / EU / Asia (selectable) | SOC 2 Type II |
| Google Workspace | Customer's own Drive (screenshot storage) | Customer-controlled | SOC 2 / ISO 27001 |
| Cloudflare | R2 (binary distribution), Workers | Global edge | SOC 2 Type II / ISO 27001 |
| Firebase RTDB | Push-config signaling (no media) | Asia-Southeast | SOC 2 / ISO 27001 |
What we collect — and what we don't
✓ We collect
- • Active application name + window title
- • URLs visited (in non-private windows)
- • Active vs idle time (mouse/keyboard activity timing only)
- • Periodic screenshots (configurable interval)
- • USB device connect/disconnect events
- • Clipboard contents only when matching a configured DLP pattern
✗ We never collect
- • Keystrokes
- • Microphone audio
- • Webcam video
- • Personal device content
- • Files from personal cloud accounts
- • Banking credentials or stored passwords
Customer & employee rights
📤
Right to access
Self-service JSON export of all data on any employee via the Compliance dashboard.
🗑
Right to erasure
One-click cascade-delete: activity, screenshots, DLP events, user — atomic.
🚫
Right to object
Employees can object directly to the customer's DPO listed on the auto-rendered privacy notice.
Incident response
If you suspect a security incident:
📧 security@reevtech.in
📞 Acknowledge within 4 business hours
📋 Full notification within 72 hours as required by GDPR Art. 33
Documentation on request
Enterprise customers may request the following under NDA by emailing support@reevtech.in:
- 📄 Standard Contractual Clauses (EU SCCs 2021/914)
- 📄 Business Associate Agreement (HIPAA BAA)
- 📄 DPIA template (pre-completed for our processing)
- 📄 Penetration test summary
- 📄 Sub-processor list (current + change-of-processor notice policy)
- 📄 Disaster recovery & business continuity plan