Security Overview

SOC 2 Type II Infrastructure

Hosting infrastructure maintains a SOC 2 Type II attestation, audited annually. The attestation is held by the infrastructure provider; EM Scheduling inherits these controls at the infrastructure layer and does not maintain an independent SOC 2 report.

Daily Database Backups

The PostgreSQL database is automatically backed up daily by the managed infrastructure provider, with backups retained on a rolling window.

US Data Residency

All data is stored in US-based cloud infrastructure (AWS us-east-1). Data does not leave US jurisdiction.

Encryption in Transit and at Rest

Data is encrypted at rest with AES-256 and in transit with TLS 1.2+. Encryption at rest is applied at the storage layer.

Tenant Isolation via Row Level Security

Program-level isolation is enforced by PostgreSQL Row Level Security policies at the database layer, not in application code. Policies are default-deny, and queries are scoped to the requesting user's program; cross-program access is denied at the policy layer.

Role-Based Access Control (RBAC)

Access is governed by a tiered role hierarchy enforced server-side through RLS policies and Edge Function authorization checks. Privilege escalation is rejected at the database layer.

Multi-Factor Authentication

MFA is available via TOTP and email OTP. Authentication and assurance level are verified server-side, and JWT access tokens are validated on every request.

Session Expiration

Sessions expire after a configurable period of inactivity. The timeout is set per deployment.

Server-Side Authorization via Edge Functions

State-mutating operations route through Edge Functions that enforce input validation, field allowlisting, and per-request authorization. Authorization is never performed client-side.

Audit Logging

Security-relevant events — authentication, password changes, MFA enrollment and removal, and privilege changes — are logged with timestamp and actor. Records are available on request.

PCI DSS Payment Processing via Helcim

Payments are processed by Helcim, a PCI DSS Level 1 service provider. Cardholder data is never stored, processed, or transmitted by EM Scheduling systems; card entry occurs within Helcim's environment.

Security Event Notifications

Email notifications are sent on sensitive account events — password resets, MFA enrollment and removal, and privilege changes.

Data Use and Retention

Customer data is processed solely to operate the service. It is not sold, licensed, or shared for advertising or analytics. Data is deleted on request at offboarding.